A media company stores a year of CloudTrail and VPC flow logs in S3 totaling 8 TB and must find which IAM principal deleted production buckets and trace lateral movement quickly without moving data. Which log analysis approach should the analyst use to query findings efficiently?

Amazon Athena queries CloudTrail and flow logs directly in S3 with standard SQL, partition pruning, and ad hoc joins to identify deleter principals and lateral hosts, while Security Hub aggregates correlated findings for prioritization, which suits large historical datasets without ingestion. CloudWatch Logs Insights fails by concept because it analyzes log groups in CloudWatch, not multi-terabyte S3 archives, and cannot run partitioned S3 SQL. GuardDuty Malware Protection fails by concept because it scans for malware rather than providing SQL analytics over logs. CloudTrail Lake dashboards with Macie fails by concept because Lake (now closed to new customers) requires ingestion into its event store and Macie focuses on S3 sensitive-data discovery, not general SQL over existing buckets. Exam caveat is to match Athena to S3-based analysis and Logs Insights to CloudWatch log groups, and practical check is to verify table partitions by date and region to reduce scanned data.