An analyst needs to filter millions of stored CloudTrail records by principal, event name and time range while investigating an incident. Which approach is most efficient?
Show answer and explanation
Answer: B
Athena can query CloudTrail log files directly in S3 using SQL, so an analyst can select by event name, principal ARN, source address or time window without loading the data anywhere. A table created with the CloudTrail SerDe understands the nested JSON structure and keeps costs low by scanning only the requested columns.
The S3 bucket remains the durable store while Athena supplies ad hoc investigation.
Why the other options are wrong
- A. Downloading and manually reading gzip log files does not scale beyond a handful of records and risks losing track of which files were reviewed.
- C. Insights only surfaces unusual call volume and error rates. It cannot return matching events for a specific principal or time range.
- D. Config tracks resource configuration history, not API request records, so it cannot answer who called which API at a given moment.