Question

A security team must run ad hoc SQL queries against 18 months of CloudTrail management events to investigate historical API activity. Currently, CloudTrail delivers logs to an S3 bucket, and the team queries them using Athena. However, they find that maintaining Athena table partitions and re-running the AWS Glue crawler as new log prefixes arrive is error-prone, and some queries return incomplete results because partitions were not updated. The team wants a managed solution that requires no partition management and lets them query events with SQL for up to 7 years. Which approach best meets these requirements with the least ongoing maintenance?

Accepted Answer

Create a CloudTrail Lake event data store with an extended retention period and run SQL queries directly against it.

Answer

Enable Athena partition projection on the existing CloudTrail table and configure a longer S3 lifecycle retention.

Answer

Send CloudTrail logs to CloudWatch Logs and use CloudWatch Logs Insights to query the 18-month history.

Answer

Schedule a daily AWS Glue crawler run via EventBridge to keep the Athena partitions current and store logs in S3 Glacier.