Could also add a warning in the case that isOrganizationTrai: true and orgId is not provided. Probably not an error even though it would fail to deploy since some users may have manually added the missing policy already and won't need to use the new orgId prop.

Warning could be something like this but any alternative suggestions are welcome:
Organization Trails require passing in an organization id using the orgId property to attach a missing policy.

Why does it call orgId? Reaching this link, it seems to be The name of the folder where the log files are stored, including the bucket name, a prefix (if you specified one), and your AWS account ID. So more like account id?

The missing permission is specified under this section for organization trails. Specifically the third policy in that section which requires the o-organizationID:

{
            "Sid": "AWSCloudTrailOrganizationWrite20150319",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "cloudtrail.amazonaws.com"
                ]
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::myOrganizationBucket/AWSLogs/o-organizationID/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control",
                    "aws:SourceArn": "arn:aws:cloudtrail:region:managementAccountID:trail/trailName"
                }
            }
        }

Apologies, I just realized the link to the exact code block just redirects you to the top of the page which is a bit misleading.

This makes a lot more sense! Thanks!

In the doc, it mentions "arn:aws:s3:::myBucketName/[optionalPrefix]/AWSLogs/myAccountID/*". I haven't looked deep into it, but is the optional prefix part of the bucket and it would be handled by this.s3bucket.arnForObjects?

It would be this value for the resources: "arn:aws:s3:::myOrganizationBucket/AWSLogs/o-organizationID/*" where arn:aws:s3:::myOrganizationBucket/ is handled by this.s3bucket.arnForObjects. But for the case you're talking about it would not handle it, the optional prefix part is passed in from props:

    this.s3bucket.addToResourcePolicy(new iam.PolicyStatement({
      resources: [this.s3bucket.arnForObjects(
        `${props.s3KeyPrefix ? `${props.s3KeyPrefix}/` : ''}AWSLogs/${Stack.of(this).account}/*`,
      )],

Looking at the below snippet, wouldn't the orgId be this.s3bucket.stack.account?

Resource": "arn:aws:s3:::myBucketName/[optionalPrefix]/AWSLogs/myAccountID/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control",
                    "aws:SourceArn": "arn:aws:cloudtrail:region:myAccountID:trail/trailName"
                }
            }

That's a different permission from that one we are adding here:

"Resource": "arn:aws:s3:::myOrganizationBucket/AWSLogs/o-organizationID/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control",
                    "aws:SourceArn": "arn:aws:cloudtrail:region:managementAccountID:trail/trailName"
                }
            }