A healthcare company in three Regions and 40 accounts must retain audit trails of management actions, Bedrock model prompts and outputs, and configuration drift with centralized security findings. Which centralized logging design captures organization activity, AI invocations, and configuration compliance?

The correct design covers all domains with organization scale: organization CloudTrail trails record management actions across 40 accounts and three Regions with automatic enrollment, Config aggregator centralizes configuration history and rule evaluation for drift, Security Lake provides normalized centralized retention, Security Hub consolidates findings for response, and Bedrock invocation logging retains prompts and outputs not captured elsewhere. The alternative using organization trails with Config aggregator and centralized Security Hub handles identity, configuration and posture well but fails on AI auditability because without Bedrock logging generative prompts and completions are not durably retained. The alternative using organization trails with Security Lake, Security Hub and Bedrock logging retains audit and AI telemetry effectively but fails on configuration governance because without Config aggregation there is no managed drift evaluation and timeline. The alternative using account-level trails and recorders with Security Hub and Bedrock logging forwarded to central buckets suits small deployments but fails on organization governance because it lacks enforced org-wide coverage and automatic enrollment for new accounts and Regions. For exams, separate CloudTrail API auditing from Bedrock model invocation logging, since AI retention needs explicit configuration and privacy controls. Practically, confirm in the management account that the org trail, aggregator, delegated Hub administrator, Lake subscribers and Bedrock log destination are healthy in every in-scope Region.