A company will migrate from on‑premises to AWS and will use multiple AWS accounts managed under AWS Organizations. They will create a few accounts initially and add more later. A solutions architect must enable AWS CloudTrail for all accounts. What is the MOST operationally efficient design to enable CloudTrail across the organization?

Creating a single CloudTrail trail in the organization's management account and configuring it to log events for all AWS accounts is the most operationally efficient solution. This approach leverages AWS Organizations' native integration with CloudTrail, automatically applying the trail to new and existing accounts without manual intervention or custom automation. The other options are less efficient: A Lambda function or Systems Manager Automation runbook would require custom development and maintenance, and might miss newly created accounts if not frequently updated. Creating separate CloudTrail trails in every AWS account, even with an SCP, increases management overhead and doesn't scale as efficiently as an organization-wide trail.