A fintech operates 50 accounts emitting CloudWatch Logs for audit, needs near-real-time security analysis centrally, plus immutable 7-year archives with low-cost retention. Network controls prohibit polling each account from the central account. Which multi-account log aggregation design meets streaming and archival needs?

The correct design succeeds because CloudWatch Logs subscription filters push continuously to a central Kinesis destination via resource policy, honoring the no-polling control while feeding near-real-time consumers and delivering to S3 where Object Lock Compliance mode with Glacier tiering ensures immutable seven-year low-cost retention. The central S3 replication with Object Lock and Athena design is standard for compliant audit and low-cost SQL investigation, yet S3 batch replication plus on-demand queries provides no streaming detection engine for continuous security analysis. The push-to-Kinesis with OpenSearch analytics design is standard for live dashboards and anomaly detection, yet searchable hot storage with 90-day retention provides no WORM immutability or seven-year Glacier economy. The central Lambda assuming cross-account roles to fetch logs each minute is a proven hub-and-spoke collector with S3 storage, yet initiation from the center makes it a polling pull model that directly breaches the network prohibition and risks throttling across fifty accounts. For exams, prioritize push versus pull and streaming versus batch language, remembering Athena with S3 alone never equals streaming and OpenSearch alone never equals vault archiving. Practically, validate filters and destination policies in all accounts, confirm S3 Object Lock with seven-year rule and Deep Archive lifecycle, and test event-to-alert latency plus restore.