An audit team needs centralized configuration visibility across accounts and Regions, but remediation must follow approved per-account workflows. Which design fits?

1. Replace all configuration assessment with monthly invoice exports.
2. Assume the aggregator automatically fixes every finding in every account.
3. Use a Config aggregator for visibility and separate authorized remediation workflows.
4. Give auditors root passwords to perform untracked fixes directly.