A company using AWS Organizations (all features enabled) has separate accounts per business unit. Administrators in each account must use Amazon Athena to view detailed cost and usage data for only their own account. IAM permissions to configure Cost and Usage Reports are available, and a centralized Cost and Usage Report for the entire organization is already delivered to an S3 bucket. Which approach provides the required per-account access with the least operational complexity?

The correct approach centralizes the CUR in the management account and uses a Lambda function to process new reports. The Lambda function can filter the data by account and store it in separate S3 prefixes. A bucket policy can then grant each member account read access to only its specific prefix, ensuring data isolation and least privilege. This is operationally simple because it automates data segregation and access control from a single point. Sharing the raw CUR data via AWS RAM (option 1) would give member accounts access to the entire organizational CUR, violating the requirement for per-account data access. Creating separate CURs for each member account (option 4) would be operationally complex, requiring individual CUR configurations and S3 buckets for each account. Using AWS Cost Explorer (option 3) doesn't directly address the requirement to use Athena for detailed cost and usage data from the CUR, and it wouldn't provide the raw data needed for custom analysis.