Which AWS feature helps centralize and aggregate security and audit logs from multiple accounts?

• A. AWS Config multi-account configuration
• B. AWS CloudTrail multi-account trails with a central log sink
• C. Amazon Macie
• D. AWS GuardDuty

Answer: (B)

Centralized log collection across multiple AWS accounts is achieved with AWS CloudTrail Organization Trails that deliver to a central log sink. By enabling an organization-wide trail, API activity from every account in the AWS Organization is recorded and written to a single S3 bucket (the central log sink) in the designated account. You can also stream these logs to CloudWatch Logs for real-time monitoring. This setup provides a single, auditable repository of security and event data across all accounts, simplifying investigations, compliance, and governance.

Other options don’t fit because they don’t aggregate security and audit logs across accounts: AWS Config multi-account configuration focuses on configuration history and compliance data rather than API activity logs; Amazon Macie is for discovering sensitive data in S3; AWS GuardDuty is a threat-detection service that analyzes logs but does not centralize logs across accounts.