Question

A CloudOps engineer must retain all VPC Flow Logs and application logs for long-term compliance in Amazon S3, then run periodic ad-hoc SQL queries against them for security investigations. The logs currently arrive in a CloudWatch Logs log group. The solution must be cost-effective, require minimal ongoing management, and avoid running continuous compute. Which approach best meets these requirements?

Accepted Answer

Create a CloudWatch Logs subscription filter that streams the log group to Amazon Data Firehose, which delivers records to an S3 bucket, then query the data with Amazon Athena.

Answer

Configure a CloudWatch Logs subscription filter to invoke a Lambda function that writes each log event to Amazon DynamoDB, and query the table with PartiQL.

Answer

Use CloudWatch Logs Insights to query the log group directly and set the log group retention to 10 years for compliance.

Answer

Export the log group to S3 on a recurring schedule using the CreateExportTask API triggered by EventBridge, then query the exported files with an always-on EMR cluster.