Question

A security engineer is performing root cause analysis for an incident that spanned three AWS accounts and two Regions. CloudTrail logs are delivered to a central S3 bucket in a dedicated log-archive account, partitioned by account, Region, and date. The engineer needs to run ad hoc SQL queries across all accounts and Regions to reconstruct the attacker's API activity timeline, while keeping query costs low and avoiding data movement. Which approach best meets these requirements?

Accepted Answer

Create an Athena table over the central S3 bucket, define partition projection on the account/Region/date keys, and run SQL queries scoped to relevant partitions.

Answer

Load all CloudTrail logs into an Amazon Redshift cluster in the log-archive account and query the events using the Redshift query editor.

Answer

Enable CloudTrail Lake in each source account and query events separately per account, then manually merge the CSV exports in a spreadsheet.

Answer

Use CloudWatch Logs Insights on each account's log group and export the correlated results to the central bucket for review.