Question

A network operations team publishes VPC Flow Logs from 40 production VPCs to a single S3 bucket for security auditing. Analysts run daily Amazon Athena queries filtering by date and account, but query costs and runtimes have grown sharply as data volume increased. The team wants to reduce both the amount of data Athena scans and the ongoing query cost, while keeping all historical logs accessible. Which approach best achieves this?

Accepted Answer

Enable Hive-compatible S3 prefixes when creating the Flow Logs and partition the Athena table by region, account ID, and date so queries scan only relevant partitions.

Answer

Change the Flow Logs destination from S3 to CloudWatch Logs and query with CloudWatch Logs Insights instead of Athena.

Answer

Reduce the Flow Logs maximum aggregation interval from 10 minutes to 1 minute to produce smaller individual log files.

Answer

Enable S3 Transfer Acceleration on the logging bucket to speed up Athena data retrieval.