Logs from the last 30 days need fast OpenSearch queries, while one year must be retained cheaply.
Avoid growing the search cluster indefinitely and meet the audit requirement.
Which storage approach is most appropriate?
Keep the hot search window in OpenSearch and archive older logs in protected S3 storage with a documented re-ingestion path.
Detailed explanation
Index storage and operational cost grow continuously and capacity risk increases.
Index storage and operational cost grow continuously and capacity risk increases.
CloudTrail does not capture all application log content.
CloudTrail does not capture all application log content.
Deleting the active search window violates the query and retention requirements.
Deleting the active search window violates the query and retention requirements.
Search performance and long-term storage cost can be managed as separate tiers.
Search performance and long-term storage cost can be managed as separate tiers.
Check official documentation
Compare the following points with the official documentation.
Amazon OpenSearch Service UltraWarm、cold storage、S3 lifecycleの公式説明を確認する。
What to confirm
検索クラスタと長期アーカイブを分離する理由を説明できる。
Key points
- Hot/Warm/Cold
- S3 archive
- Retention
- Re-ingestion
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Tier selection
Compare search frequency, restore time, storage price, and audit retention.
Evidence continuity
Preserve source, timestamp, and integrity metadata when archiving and re-ingesting.