Gathering AWS CloudTrail logs from multiple accounts in a single bucket (AWS Control Tower)

Question

Our organization is using an AWS multi-account structure, and we leverage AWS Control Tower to provision accounts, handle certain security restrictions, and centralize CloudTrail logs.

With Control Tower, the CloudTrail logs of all accounts end up in a single S3 bucket that is owned by the "Log Archive" account.

To integrate with Azure Sentinel, we created an IAM Role with the "CloudTrail Read-Only" policy (as described in the AWS connector documentation page) in the Log Archive account. We can see logs pertaining to the Log Archive account in Sentinel / Log Analytics, but not the logs of any of the other AWS accounts (which we do see in the S3 bucket).

As a workaround, we can configure the AzureSentinel role in each of the AWS accounts and add the role ARNs individually to the connector settings (which should work, but we haven't yet tested it). However, that means we need to keep track of each AWS account that is created by Control Tower and ensure that we don't forget to configure it on the Azure Sentinel side -- a somewhat risky approach in the long-run.

Is there a recommended way of dealing with this type of situation? Is anyone aware of upcoming changes to Sentinel that would address this?

Thank you