A company must aggregate Amazon CloudWatch Logs from multiple AWS accounts into a central logging account. Logs must remain in their Region of origin. The central account will normalize logs and stream them to a security tool. The solution must handle high ingestion volume and scale with diurnal load (heavier in business hours). Using an AWS Control Tower design for multi-account logging, which combination of steps should be implemented? (Choose three.)

A Kinesis data stream in the central logging account is ideal for high-volume, real-time log ingestion, as it can handle fluctuating loads and stream data efficiently. An SQS queue is less suitable for continuous, high-throughput streaming of logs. An IAM role granting CloudWatch Logs permission to put data into the Kinesis stream, with a trust policy and subscription filters in each member account, enables secure and scalable log forwarding. Creating a single subscription filter for all log groups to an SQS queue is not the correct pattern for Kinesis. A Lambda function in the central logging account can process the aggregated logs from Kinesis, normalize them, and forward them to the security tool. Performing normalization in each member account with individual Lambda functions would be less efficient and harder to manage centrally.