Deployment in Landing Zone

[Frelthra]

Can CLO be deployed in the Audit account of a Control Tower managed landing zone?

The opinionated architecture of a Control Tower deployment seems to strongly suggest that SecOps tooling like CLO be deployed into the Audit account and from there use a Lambda function to the retrieve centralised logs from the Log Archive account.

Ref: https://docs.aws.amazon.com/controltower/latest/userguide/roles-how.html#stacksets-and-roles