Question

A network operations team ingests VPC Flow Logs to Amazon S3 for security auditing across 40 VPCs. Analysts run daily Athena queries filtered by date and account, but query costs and scan volumes have grown sharply as log volume increased. The team wants to reduce Athena data-scanned charges and improve query performance without changing the fields being captured. Which change to the Flow Logs delivery configuration is the MOST effective?

Accepted Answer

Configure the Flow Logs to deliver to S3 in Apache Parquet format with Hive-compatible S3 prefixes and per-hour partitioning enabled

Answer

Reduce the maximum aggregation interval from 10 minutes to 1 minute to produce smaller log records

Answer

Switch the Flow Logs destination from S3 to CloudWatch Logs and query with CloudWatch Logs Insights instead of Athena

Answer

Enable S3 server-side encryption with SSE-KMS on the Flow Logs bucket to compress the stored objects