A production AWS account stores security logs in CloudWatch Logs. A separate security AWS account will receive those logs for storage and analysis. The company needs to deliver the CloudWatch Logs from the production account to the security account using Amazon Kinesis Data Streams. Which approach satisfies this requirement?

The correct approach involves creating the Kinesis Data Stream in the security account, as this is the destination for the logs. An IAM role with a trust policy is then created in the security account to grant CloudWatch Logs (from the production account) permission to publish data to this Kinesis stream. Finally, a CloudWatch Logs subscription filter is created in the production account, which is where the logs originate. This filter is configured to send the logs to the Kinesis Data Stream in the security account, leveraging the cross-account permissions granted by the IAM role. Incorrect options: Creating the destination stream in the production account is wrong because the logs need to be stored in the security account. Creating an IAM role in the security account with cross-account permissions to Kinesis in the production account is incorrect because the Kinesis stream should be in the security account, and CloudWatch Logs needs permission to send data, not for the security account to read from a production stream. Creating a subscription filter in the security account is incorrect because the logs are generated in the production account, so the filter must be created there to capture and forward them.