CloudTrail Lake configuration happens in the management or, preferably, the delegated administrator account to enable logging for the entire organization. Apply the Expedition tag to identify the event data store to be monitored.
For additional details, please check out the blog post:
https://4n6ir.com/2022/08/16/cloudtrail-principles-for-success.html
