During an incident, a security engineer confirms that an EC2 instance in a private subnet has been compromised and is suspected of exfiltrating data to an external endpoint. The instance has already been isolated for forensics. The engineer now needs to determine exactly which external IP addresses and ports the instance communicated with over the past 30 days, including how much data was transferred, to support the containment and root cause analysis. VPC Flow Logs are already enabled and delivered to an S3 bucket. Which approach provides the FASTEST and MOST cost-effective way to answer these questions?