A company runs a large multi-VPC environment and currently publishes VPC Flow Logs to CloudWatch Logs across dozens of accounts. The security team occasionally queries the data for forensic investigations, but the monthly ingestion and storage cost of CloudWatch Logs has become excessive, and the queries they run (typically filtering by source/destination IP and rejected traffic over multi-day windows) are slow and expensive. The team wants to reduce cost while improving ad hoc query performance and long-term retention. Which change best meets these goals?