A company manages multiple AWS accounts with AWS Organizations. The security team notices that some member accounts are not sending AWS CloudTrail logs to a centralized Amazon S3 logging bucket. The team must ensure that every existing account and any new account has at least one trail configured. Which actions should the team take?

The correct solution is to edit an existing trail in the management account and apply it to the organization. This creates an organization trail, which logs all events from all accounts in the organization to a single S3 bucket. This ensures that every existing and new account has at least one trail, meeting the requirement for centralized logging. Creating a new trail and using EventBridge only addresses notifications for trail status, not the creation of trails in all accounts. Deploying Lambda functions in every account is an operational overhead and doesn't guarantee new accounts will have trails. Creating an SCP only prevents deletion or stopping of trails but doesn't ensure a trail exists in the first place.