A fintech operates 45 AWS accounts with app logs in CloudWatch Logs and must retain seven years for regulators. Security wants one searchable archive, encrypted and tamper-evident, with tiered storage for cost control. Which observability design delivers centralized multi-account log aggregation with tiered archival?
Select an answer to reveal the explanation.
Short Explanation
You'll stop chasing logs across 45 accounts when you funnel them into one central library that gets cheaper over time. Cross-account filters feed Firehose into S3 where lifecycle rules slide older logs to low-cost tiers.
Full Explanation
The centralized Firehose to S3 pattern succeeds because cross-account subscription filters continuously forward CloudWatch application logs to one delivery stream, where Firehose batches and encrypts data into a central S3 bucket enforcing SSE-KMS, Object Lock for tamper evidence, and lifecycle transitions to Infrequent Access and Glacier for economical seven-year retention queryable with Athena for one searchable archive. Centralized CloudWatch cross-account observability with native retention fails on lifecycle economics because Logs offers encrypted central querying but lacks S3-class tiering, making seven-year hot retention costly and violating tiered cost control. A central encrypted OpenSearch domain with seven years of hot storage fails on archival cost by providing excellent searchable analytics but without cold tiers, so sustained compliance retention breaks tiered-storage requirements and scaling limits. An organization-wide CloudTrail Lake with immutable tiered storage fails on log-source scope because it aggregates management audit trails with integrity controls, not the specified CloudWatch application logs, leaving regulated telemetry unarchived. Exam caveat: distinguish audit-trail centralization from application-log centralization and hot analytics from tiered archiving, as stems requiring both searchable and tiered point to Firehose to S3. Practical check: confirm bucket KMS, Object Lock compliance mode, lifecycle to Deep Archive, cross-account Firehose roles, and Athena partitioning for recoverability.