Question

A security engineer stores several years of CloudTrail logs in an S3 bucket organized by the standard prefix pattern (AWSLogs//CloudTrail/////). Analysts run frequent Athena queries filtered to a specific account, region, and date range, but queries are slow and scan far more data than expected, driving up cost. The engineer wants to reduce data scanned and query time without running a crawler or manually adding partitions each day. Which approach best meets these requirements?

Accepted Answer

Enable partition projection on the Athena table by defining partition keys (region, date) with projection type and ranges in the table properties so partitions are calculated at query time.

Answer

Convert all existing CloudTrail JSON logs to a single uncompressed CSV file and re-create the Athena table pointing at it.

Answer

Schedule an AWS Glue crawler to run every hour to discover and register new partitions in the Data Catalog.

Answer

Increase the Athena query result location storage class to S3 Intelligent-Tiering to lower scan costs.