A fintech centralizes CloudTrail, VPC Flow Logs, and GuardDuty findings in an S3 log archive across three Regions. Analysts need ad hoc SQL joins across months of data without managing servers or moving data. Which solution should the detection architect select to analyze centralized logs for threats?

Amazon Athena is the correct choice because it is serverless, queries objects directly in S3 without ingestion or ETL, and supports standard SQL including joins across large partitioned datasets, which exactly matches ad hoc analysis of months of CloudTrail, VPC Flow Logs, and GuardDuty findings centralized across Regions when tables are partitioned by date, Region, and account for pruning and cost control. The EKS Presto approach fails on operational model because even though Presto with the S3 connector can federate and join S3 data efficiently, running it self-managed on Kubernetes reintroduces cluster sizing, patching, scaling, and availability management that the scenario explicitly forbids. The Redshift Serverless approach fails on data movement because even though it is serverless and excellent for complex SQL joins, it requires COPY or ingestion pipelines to load S3 logs into managed tables, creating duplication, latency, and ongoing VACUUM and distribution management contrary to the without moving data requirement. The OpenSearch Serverless approach fails on analytics type because even though direct queries can search S3 in place without provisioning, its engine is optimized for full-text search, relevance ranking, and dashboards rather than relational ad hoc SQL joins across months of heterogeneous logs. An exam caveat is to distinguish in-place query from zero-ETL ingestion and to treat keywords like without managing servers and without moving data as strong selectors for Athena over warehousing or self-managed engines, while a practical check before the exam or implementation is to confirm Glue Data Catalog coverage, partition projection or MSCK REPAIR, Parquet or Gzip partitioning, and Region-aware prefixes with workgroup encryption and query-result bucket controls.