Which solution will meet these requirements?

Explanations:

AWS CloudTrail captures AWS account activity and API usage but does not specifically log authentication failures for S3 bucket access attempts. Saving to CloudWatch Logs with a 90-day retention period does not fulfill the requirement of preventing overwriting or deletion of logs for 90 days.

While AWS CloudTrail can log API calls, including access attempts to S3, simply saving the logs to a different S3 bucket does not ensure the logs are protected from deletion or overwriting for 90 days. CloudTrail log file integrity validation is not a retention mechanism.

Access logging for S3 buckets provides information about requests to access objects in the bucket, but saving these logs to CloudWatch Logs with a retention period does not prevent deletion or modification of logs, which does not meet the requirement for immutability.

Enabling access logging for the S3 bucket allows tracking of access requests, while saving logs to a second S3 bucket with S3 Object Lock configured ensures that logs cannot be deleted or overwritten for 90 days, fulfilling the requirement for log retention and protection.