Explanation

Correct Answer: D

Why Option D is correct:

1. VPC Flow Logs can be published directly to Amazon S3 - This is a supported destination for VPC Flow Logs.
2. S3 Lifecycle policies allow you to automatically transition objects to different storage classes based on age.
3. S3 Standard-IA (Infrequent Access) is designed for data that is accessed less frequently but requires rapid access when needed.
4. The requirement states:
   • Logs will be frequently accessed for 90 days (S3 Standard is appropriate)
   • Then accessed intermittently after 90 days (S3 Standard-IA is appropriate)
5. Cost optimization: S3 Standard-IA is cheaper than S3 Standard for infrequently accessed data.

Why other options are incorrect:

A. Amazon CloudWatch with 90-day expiration:

• CloudWatch Logs can retain logs for up to 10 years, but the requirement is for logs to be accessible after 90 days, just less frequently.
• Setting expiration to 90 days would delete the logs entirely, not make them available intermittently.

B. Amazon Kinesis with 90-day retention:

• Kinesis Data Streams have a maximum retention period of 7 days (extended retention up to 365 days is available but expensive).
• Kinesis is designed for real-time data processing, not long-term log storage.
• This would be expensive and not cost-effective for the requirement.

C. AWS CloudTrail with S3 Intelligent-Tiering:

• CloudTrail is for API activity logging, not VPC Flow Logs.
• VPC Flow Logs cannot be sent to CloudTrail as a destination.
• While S3 Intelligent-Tiering could work, the approach is incorrect because it uses the wrong service (CloudTrail) as the target.

Key AWS Services Knowledge:

• VPC Flow Logs Destinations: Can publish to CloudWatch Logs, S3, or Kinesis Data Firehose.
• S3 Storage Classes:
  • S3 Standard: Frequently accessed data
  • S3 Standard-IA: Infrequently accessed data with rapid access
  • S3 Intelligent-Tiering: Automatically moves data between frequent and infrequent access tiers
  • S3 Glacier: Long-term archival
• Lifecycle Policies: Automate transitions between storage classes based on object age.

This solution meets both the functional requirement (capturing VPC Flow Logs) and the cost optimization requirement (transitioning to cheaper storage after 90 days).