A retailer operates 20 member accounts across two Regions, must aggregate order events centrally for analytics, preserve source account context, enforce least-privilege event access, and forward events reliably across Regions. Which cross-account event routing pattern meets these needs?

The correct pattern succeeds because per-account custom EventBridge buses isolate member order-event production, rules enable selective cross-Region forwarding to a central analytics bus for reliable aggregation, the event envelope automatically preserves source account and source detail for attribution, and a resource-based policy on the central bus allows PutEvents only for specific member accounts and roles to enforce least privilege. The default-bus approach with open publishing supports centralized cross-Region delivery but violates least-privilege access by permitting all principals to publish, enabling noisy-neighbor and spoofed events that custom buses and resource policies are meant to prevent. The unsecured central-bus approach maintains isolation and context and can forward across Regions, but without a resource policy on the central bus restricting which member accounts may publish, it fails the least-privilege requirement. The Kinesis-based streaming approach provides centralized ingestion with cross-Region replication but loses native event-routing semantics for account, bus, rule matching and resource policies needed to preserve source context and enforce fine-grained access. Exam caveat: distinguish aggregation from failover, as global endpoints aid resilient ingestion but do not alone provide least-privilege aggregation with preserved context. Practical check: publish test events from each account in both Regions, verify central arrival with intact account fields, confirm denial for unauthorized principals, and monitor forwarding health.