Question

A security engineer needs to enable VPC Flow Logs across 40 VPCs in a single account for long-term retention (2 years) and periodic ad-hoc SQL analysis of traffic patterns. The solution must minimize ongoing cost and operational overhead while allowing the security team to query historical data on demand. Which approach best meets these requirements?

Accepted Answer

Publish flow logs directly to an S3 bucket with a lifecycle policy transitioning older data to S3 Glacier, and use Amazon Athena to query the logs on demand.

Answer

Publish flow logs to CloudWatch Logs with 2-year retention and run CloudWatch Logs Insights queries when needed.

Answer

Publish flow logs to CloudWatch Logs, create a subscription filter to stream them to Amazon OpenSearch Service, and query using OpenSearch Dashboards.

Answer

Publish flow logs to Amazon Kinesis Data Firehose and deliver them to Amazon Redshift for long-term storage and SQL analysis.