An auditor needs access to logs that record all API events on AWS. The auditor only needs read-only access to the log files and does not need access to each AWS account. The company has multiple AWS accounts, and the auditor needs access to all the logs for all the accounts. Which of the following options is the best way to configure access for the auditor to view event logs from all accounts?

Answer options:

A.Configure the CloudTrail service in each AWS account, and have the logs delivered to an AWS bucket on each account, while granting the auditor permissions to the bucket via roles in the secondary accounts and a single primary IAM account that can assume a read-only role in the secondary AWS accounts.
B.Configure the CloudTrail service in the primary AWS account and configure consolidated billing for all the secondary accounts. Then grant the auditor access to the S3 bucket that receives the CloudTrail log files.
C.Configure the CloudTrail service in each AWS account and enable consolidated logging inside of CloudTrail.
D.Configure the CloudTrail service in each AWS account and have the logs delivered to a single AWS S3 bucket in the primary account. Create an IAM user for the auditor with an IAM policy to S3 read-only access for only the bucket which stores the CloudTrail logs in the primary account.

Answer: D
Option A is incorrect since the auditor should only be granted access to one AWS account (Primary account) as a best practice.
Option B is incorrect since consolidated billing would not help aggregate and transfer logs from all the other accounts to the primary account.
Option C is incorrect since there is no such option to consolidate logging inside of CloudTrail.
Option D is CORRECT because we always assume the method of "least privilege" security design and only allow the auditor access to the minimum amount of AWS resources as possible. We can configure CloudTrail from all the accounts to store the logs into one single S3 bucket under one AWS account (Primary account). We can set up an IAM user for the auditor and provide an IAM policy to read-only contents from the above created S3 bucket.
For more information on CloudTrail, kindly refer to the following URL:
https://aws.amazon.com/cloudtrail/