A company is setting up a new AWS environment using AWS Control Tower. They need to ensure that all VPC flow logs across all member accounts are centralized into a single Amazon S3 bucket in a dedicated Log Archive account. The solution must prevent member account administrators from modifying or deleting the flow logs. What is the MOST operationally efficient solution?

Create a custom AWS Config rule in each account to enforce VPC Flow Logs. Use an IAM role to write to the central bucket.

Use AWS CloudFormation StackSets delegated administration to deploy VPC Flow Logs to all accounts. Apply an SCP to deny ec2:DeleteFlowLogs.

Configure AWS CloudTrail to capture VPC Flow Logs and route them to the Control Tower Log Archive bucket.

Use Amazon EventBridge in each account to route flow logs to a central Kinesis Data Firehose.