A fintech on AWS Organizations uses Bedrock models and needs centralized tamper-evident audit of management events, AI prompts and responses, plus aggregated misconfiguration detection across all accounts. Which centralized logging and configuration design meets these needs?
Select an answer to reveal the explanation.
Short Explanation
Scattered logs hide the story you need during incidents. One lake for trails, model calls, and config gives centralized visibility without guesswork.
Full Explanation
The correct architecture works because it unifies all domains centrally with evidentiary control: an organization CloudTrail provides cross-account management events with digest validation and S3 Object Lock for tamper-evident retention, Bedrock invocation logging records prompts, completions and metadata for AI accountability, Config aggregator supplies cross-account inventory and rule evaluation for misconfiguration detection, and Security Lake centralizes OCSF data for audit analytics. The CloudTrail Lake design with Config aggregation and Security Lake integration is a strong analytics pattern but misses the AI mandate because without Bedrock invocation logging prompts and responses are not captured. The design that centralizes CloudTrail and Bedrock data in Security Lake while keeping Config rules account-local preserves API and model auditability but misses aggregated posture management because isolated rules provide no unified compliance view or drift history. The design that centralizes unvalidated trails with Bedrock and Config data in CloudWatch offers usable monitoring but misses immutability because mutable log groups without digests and WORM storage cannot prove tamper evidence for fintech audits. Exam caveat is to map each requirement phrase to a distinct service feature rather than assuming central storage implies integrity, model coverage, or aggregation. Practical check is to verify trail validation, Object Lock policy, Bedrock payload logging enabled, and aggregator coverage before querying.