Creating a centralized identity account with IAM Identity Center and configuring it to allow the security team to assume predefined roles with audit-level permissions is a scalable and secure approach. It enforces the principle of least privilege and simplifies the management across the organization's accounts.

Providing direct access through different user profiles in each subsidiary's account is not an efficient solution and could lead to management complications. Assigning resource-based policies on a per-service basis can create inconsistencies and lacks central management. Providing the team with root user credentials for the audit function contradicts the best practices of secure account management, where such sensitive credentials should be used sparingly and with the utmost caution.