An architect is designing a multi-account structure. The security team requires that all AWS CloudTrail logs from all accounts be stored in a centralized, immutable S3 bucket in a dedicated 'Log Archive' account. What is the MOST secure and scalable way to implement this?

Create an Organization Trail in the management account. Configure it to log to the S3 bucket in the Log Archive account with S3 Object Lock enabled.

Create a CloudTrail trail in each account manually and point them to the centralized S3 bucket.

Use AWS Config to aggregate logs into the Log Archive account.

Stream CloudTrail logs to CloudWatch Logs in each account, then use a Lambda function to forward them to the central S3 bucket.