A hospital network keeps application logs for two years for audit. The last 30 days of logs are in CloudWatch Logs, and older logs are in an S3 bucket in Parquet format, partitioned by date and hospital site.
Auditors need to run ad-hoc SQL queries that count access events by user across the archived logs, and the on-call engineers need a saved query over the last 30 days to investigate alerts quickly.
The team wants to use managed query services and avoid loading the archive into another database.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Create an Amazon Athena table over the S3 bucket and use partition projection on the date and site columns, so that auditors query the archive directly with SQL.
BB. Export the whole archive back into a CloudWatch log group every time an audit starts, so that Logs Insights can scan all two years in one query.
CC. Save a Logs Insights query over the last 30 days of the application log group, and have the on-call engineers run it from the console when an alert arrives.
DD. Load the archive into an Amazon RDS database each night, and have the auditors query that database with SQL, so that the archive becomes ordinary tables.
EE. Turn on CloudWatch Contributor Insights rules for the log group, so that it counts access events by user for the auditors over the full two years automatically.
Athena queries the Parquet archive in place, and partition projection keeps scans small, so auditors can run SQL over the archived history. Logs Insights queries the recent 30 days in CloudWatch, and a saved query gives the on-call engineers a repeatable investigation. Re-exporting the archive, loading a database and Contributor Insights each add data movement or miss the archive.
Want more on Logs Insights, Athena and dashboards? The 5 full-length practice sets have 12 more Logs Insights, Athena and dashboards questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →