Organisation-wide Audit Trail

A fintech company with forty AWS accounts must prove to regulators who did what, in every account and Region, for the last seven years. Every API call must be recorded centrally, including in accounts created in future, and the records must be impossible to alter or delete for the retention period, even by an administrator of the logging account. The security team also wants automatic detection of threats such as credentials being used from unusual locations or instances talking to known malicious addresses, and a message to the on-call engineer within minutes of a high-severity finding.