A development VPC needs flow records only for denied traffic, stored as cheaply as possible, and the team will query them occasionally with SQL. Which delivery configuration is most economical?
Show answer and explanation
Answer: C
Flow logs can filter to rejected traffic, and delivering to S3 in Parquet produces compact columnar files that Athena scans efficiently. Together, filtering and columnar storage minimize both storage and query cost while keeping the denied-traffic records needed for security analysis. CloudWatch Logs ingestion is more expensive at volume, and real-time streaming to a cluster or a Kinesis stream adds infrastructure and cost without serving occasional queries.
Why the other options are wrong
- A. A self-managed cluster in real time adds ongoing infrastructure and operations work. It is designed for live analysis, which the team does not need for occasional queries.
- B. CloudWatch Logs charges for ingestion and storage of every record. Sending all traffic there is costlier than filtered S3 delivery for a dev VPC.
- D. Unfiltered records to Kinesis collect accepted traffic the team does not need and require a consumer to be built and paid for. This is not the lowest-cost choice.