A healthcare holding company must aggregate CloudTrail, VPC flow, and Route 53 logs from 100 accounts into an immutable lake for 7-year retention, with automated normalization and forwarding to Splunk. Analysts need unified querying without managing pipelines per source. Which log lake integration design meets these centralization needs?

The correct design works because Security Lake automates multi-account collection of CloudTrail, VPC flow and Route 53 logs into a centralized immutable S3 lake with lifecycle policies for seven-year retention, converts all sources to OCSF for automated normalization, and provides native HTTPS subscriber forwarding to Splunk while allowing unified querying without maintaining per-source pipelines. The central S3 bucket with organization trails and Athena querying fails on normalization because raw logs still require custom parsing and schema upkeep in Athena and Splunk, leaving analysts to manage differences per source despite central storage and forwarding. The Security Lake design limited to ninety-day retention fails on compliance lifecycle because the scenario mandates immutable seven-year preservation, so short retention with federated Splunk search cannot satisfy durability even though collection and normalization are sound. The Firehose design with Lambda normalization into Splunk HEC storage fails on lake architecture because streaming delivery requires maintaining per-source streams and functions and stores results primarily in Splunk rather than in a durable queryable S3 lake with long-term immutability. As an exam caveat, distinguish Security Lake for centralized OCSF security lakes from CloudTrail Lake for CloudTrail-only analysis and from ad hoc S3 centralization without normalization. As a practical check, verify delegated administrator, subscribed Regions and log sources, S3 Object Lock plus Lifecycle beyond seven years, OCSF validation, and Splunk subscriber health with delivery lag.