Querying S3 JSON Logs with Minimal Overhead

SAA-C03 By islever Editorial Last updated

Determine high-performing data ingestion and transformation solutions.

Short answer

C Use Amazon Athena to run on-demand SQL queries directly against the JSON log files already stored in Amazon S3, with no data loading or cluster management.

Question

A company needs the ability to analyze the log files of its proprietary application. The logs are stored in JSON format in an Amazon S3 bucket. Queries will be simple and will run on-demand. A solutions architect needs to perform the analysis with minimal changes to the existing architecture.
What should the solutions architect do to meet these requirements with the LEAST amount of operational overhead?
  1. Use Amazon Redshift to load all the content into one place and run the SQL queries as needed.
  2. Use Amazon CloudWatch Logs to store the logs. Run SQL queries as needed from the Amazon CloudWatch console.
  3. Use Amazon Athena directly with Amazon S3 to run the queries as needed. Correct Answer
  4. Use AWS Glue to catalog the logs. Use a transient Apache Spark cluster on Amazon EMR to run the SQL queries as needed.

Key Takeaways

The question tests serverless ad-hoc querying of existing S3 data, and the trap is choosing a heavier service (Redshift load, EMR cluster, CloudWatch storage migration) that adds ingestion steps, infrastructure, or architectural change the scenario explicitly excludes.

Amazon Athena lets you run standard SQL ad-hoc queries directly against JSON log files already stored in Amazon S3, with no data loading, no clusters, and no changes to the existing architecture. This page explains why Athena satisfies the simple, on-demand, least-operational-overhead requirement better than Redshift, CloudWatch Logs, or an EMR Spark cluster.

Common mistake: Option A (Redshift) is the most tempting wrong pick because it is a familiar SQL warehouse, but it forces a full copy of every log file into a cluster you must provision, patch, and pay for continuously — directly violating 'minimal changes' and 'LEAST operational overhead' for simple on-demand queries.

Expert Analysis

Why the Answer Is Correct

Amazon Athena is a serverless interactive query service that runs ANSI SQL directly against data that already lives in Amazon S3, including JSON files, so the architect points Athena at the existing bucket and queries run in seconds. Because the logs are already in S3 in JSON format, no extract/load step, no schema migration, and no persistent compute is required, which precisely matches 'minimal changes to the existing architecture.' Athena is on-demand by design: there is no cluster to start or stop, no infrastructure to manage, and billing is per query scanned, so simple sporadic queries cost very little. AWS documentation, quoted in the top comment, states Athena lets you "begin using standard SQL to run ad-hoc queries and get results in seconds." This is the textbook least-operational-overhead answer for ad-hoc S3 analytics.

Why the Other Options Are Wrong

Option A requires loading all log content into a Redshift cluster, which means provisioning and maintaining a database, moving data out of its current path, and ongoing cost — a two-step process that is oversized for simple on-demand queries and contradicts minimal architectural change. Option B fails because CloudWatch Logs is an ingestion and retention service, not a SQL engine; there is no console where you run SQL queries over your S3 JSON logs, and moving the logs there would itself be a major architecture change. Option D needs a Glue Data Catalog plus a transient EMR Spark cluster, which introduces job management, IAM and metastore setup, and cluster lifecycle handling — far more operational overhead than a serverless query service for trivial SQL. As andreadhelpra noted, "CloudWatch does not have a console where you can run queries."

Community Comment Notes

Community consensus is unanimous on C, with airraid2010, PhucVuu, Guru4Cloud, cookieMr, and others all selecting it. PhucVuu keyed on "Queries will be simple and will run on-demand" and warned that Redshift becomes relevant only "for complex query we will apply Redshit [Redshift]." Guru4Cloud emphasized that "there is no need for data transformation or loading into another service" because Athena reads the S3 JSON directly. andreadhelpra added that "The data is not complex so Redshift and EMR are a overhead or simply not suitable," reinforcing the operational-overhead framing of the question.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

On SAA-C03, treat 'least operational overhead' plus 'existing data in S3' plus 'simple ad-hoc SQL' as a signal for the serverless option (Athena) rather than a provisioned cluster. Eliminate any answer that requires copying data into a new service before you can query it.

Frequently Asked Questions

Why not use Amazon Redshift to query the JSON logs in S3?

Redshift requires loading the logs into a provisioned cluster you must create, scale, and patch, adding cost and steps. For simple on-demand queries, Athena's serverless in-place SQL is far lower overhead.

Can Amazon CloudWatch Logs run SQL queries on S3 log files?

No. CloudWatch Logs is for log ingestion, storage, and metric filters/insights on its own log groups; it cannot run ANSI SQL against an S3 bucket, so it fails both the query and minimal-change requirements.

More SAA-C03 FAQ →

Discussion 83 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 83

  1. airraid2010 👍 85
    Answer: C Amazon Athena is an interactive query service that makes it easy to analyze data directly in Amazon Simple Storage Service (Amazon S3) using standard SQL. With a few actions in the AWS Management Console, you can point Athena at your data stored in Amazon S3 and begin using standard SQL to run ad-hoc queries and get results in seconds.
  2. PhucVuu 👍 53 Answered C
    Keyword: - Queries will be simple and will run on-demand. - Minimal changes to the existing architecture. A: Incorrect - We have to do 2 step. load all content to Redshift and run SQL query (This is simple query so we can you Athena, for complex query we will apply Redshit) B: Incorrect - Our query will be run on-demand so we don't need to use CloudWatch Logs to store the logs. C: Correct - This is simple query we can apply Athena directly on S3 D: Incorrect - This take 2 step: use AWS Glue to catalog the logs and use Spark to run SQL query
  3. Victorn 👍 5
    Amazon Athena Athena helps you analyze unstructured, semi-structured, and structured data stored in Amazon S3. Examples include CSV, JSON, or columnar data formats such as Apache Parquet and Apache ORC. You can use Athena to run ad-hoc queries using ANSI SQL, without the need to aggregate or load the data into Athena.
  4. Andreshere 👍 4
    A. Despite this option can be valid, it implies a bit of operational overhead compared with other options. Additionally, there is no need to aggregate that change to the existing architecture because we are already working in S3, and using other storage services incurs unnecessary costs. B. To collect the logs, we use CloudTrail over CloudWatch. Running SQL queries from the Amazon CloudWatch console is not recommended for this use case, since it is more used for filtering. C. Correct answer. Athena integrates seamlessly with S3 and allows you to run simple SQL queries in no time. When working with Apache Spark or with SQL in S3, using this service is the best option. D. This option incurs elevated operational overhead. Glue is not used to catalog the logs. Analyzing logs with Spark on an EMR cluster is very common, but you can do it faster with the Athena service integrated with S3 directly.
  5. Guru4Cloud 👍 4 Answered C
    Explanation: Option C is the most suitable choice for this scenario. Amazon Athena is a serverless query service that allows you to analyze data directly from Amazon S3 using standard SQL queries. Since the log files are already stored in JSON format in an S3 bucket, there is no need for data transformation or loading into another service. Athena can directly query the JSON logs without the need for any additional infrastructure.
Show 25 more comments
  1. cookieMr 👍 3 Answered C
    To meet the requirements of analyzing log files stored in JSON format in an Amazon S3 bucket with minimal changes to the existing architecture and minimal operational overhead, the most suitable option would be Option C: Use Amazon Athena directly with Amazon S3 to run the queries as needed. Amazon Athena is a serverless interactive query service that allows you to analyze data directly from Amazon S3 using standard SQL queries. It eliminates the need for infrastructure provisioning or data loading, making it a low-overhead solution. Overall, Amazon Athena offers a straightforward and efficient solution for analyzing log files stored in JSON format, ensuring minimal operational overhead and compatibility with simple on-demand queries.
  2. linux_admin 👍 3 Answered C
    Option C proposes using Amazon Athena directly with Amazon S3 to run queries as needed. This would allow for simple on-demand queries without any additional infrastructure setup or maintenance. Athena is designed for querying data stored in S3 using SQL statements and can handle a variety of file formats, including JSON. Athena also provides a serverless solution with no infrastructure to manage, allowing the solutions architect to focus on the data analysis instead of the infrastructure.
  3. andreadhelpra 👍 3 Answered C
    Amazon Athena, because it provides the easiest way to run simple SQL service on a on-demand basis on an S3 bucket. The data is not complex so Redshift and EMR are a overhead or simply not suitable. CloudWatch does not have a console where you can run queries.
  4. 17Master 👍 3 Answered C
    Amazon Athena is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL. Athena is serverless, so there is no infrastructure to manage, and you pay only for the queries that you run.
  5. D2w 👍 3 Answered C
    Amazon Athena is Serverless query service to perform analytics against S3 objects. And cz it wants minimal changes I'll definitely go with it.
  6. BoboChow 👍 3
    I agree C is the answer
  7. tt79 👍 3
    C is right.
  8. Buruguduystunstugudunstuy 👍 2 Answered C
    Answered by ChatGPT The correct solution that the solutions architect should do to meet these requirements with the least amount of operational overhead is Option C: Use Amazon Athena directly with Amazon S3 to run the queries as needed. Option C involves using Amazon Athena, which is a fully managed, serverless query service that allows you to analyze data stored in Amazon S3 using SQL. Athena is particularly well suited for analyzing JSON-formatted data, such as the log files in this case. You can use Athena to run on-demand queries against the log data in S3, without the need to set up any infrastructure or perform any data ingestion or transformation tasks.
  9. fig 👍 2 Answered C
    For analyzing JSON log files stored in Amazon S3 with minimal changes and least operational overhead, Amazon Athena is the most suitable solution. Amazon Athena (Option C): Athena is a serverless query service that allows you to directly query data in Amazon S3 using standard SQL. It's pay-per-query, so there's no infrastructure to manage, and it integrates directly with S3 without requiring data movement. This perfectly fits the "minimal changes to existing architecture" and "least amount of operational overhead" requirements. You can define a table schema over your S3 JSON logs, and then run your simple, on-demand queries.
  10. RaghavendraReddy 👍 2 Answered C
    When data is: Stored in S3 Queried occasionally/on-demand Requires SQL And the question emphasizes minimal operational overhead Think Amazon Athena first. Answer: C.
  11. baromi8282 👍 2 Answered C
    Amazon Athena is used to analyse the data directly from s3 bucket with a simple SQL Query.
  12. awsgcplearning 👍 2 Answered C
    Athena helps to analyze the data available in Amazon S3 through SQL syntax The answer is C
  13. rag300 👍 2 Answered C
    serverless to avoid operational overhead c is the answer
  14. sba21 👍 2 Answered C
    Athena allows directly query data stored in S3
  15. Mehkay 👍 2
    C is the correct option.
  16. Anjana_e2300554 👍 2 Answered C
    the correct answer is c
  17. tt79 👍 2
    Answer:C
  18. K_SAA 👍 1 Answered C
    Because the query is simples and run on demand so C is the correct answer B: use aws cloudwatch is not designed for this use-case because cloudwatch do not support SQL queries and the log json is stored in S3 and cloudwatch can not directly query from s3. Cloudwatch only support its own queries syntax not standard SQL A: use aws RedShift is not considered the right option since you would need to load all log data into Redshift, which is required more worked and high operational overhead, it goes against the requirement of this use-case queries is simple and running on demand D: use aws glue and Amazon EMR is more complex in setup and high operational overhead In conclusion, use Amazon athena is the right option, its simple and serverless meaning no infrastructure to manage.
  19. MGKYAING 👍 1 Answered C
    AWS Athena is a serverless, interactive query service that allows you to analyze data directly in Amazon S3 using standard SQL. It is commonly used for querying logs, performing ad hoc analysis, and building dashboards. Key aspects of AWS Athena include: Key Features: 1)Serverless: No infrastructure to manage; pay only for the queries you run. 3)Query S3 Data: Works directly with structured, semi-structured, and unstructured data stored in S3 (e.g., CSV, JSON, ORC, Parquet). 3)Integration: Works seamlessly with AWS Glue for data cataloging, enabling you to query datasets more efficiently. 4)SQL Support: Built on Presto, Athena supports ANSI SQL. 5)Pay-Per-Query: Pricing is based on the amount of data scanned per query.
  20. whileloops 👍 1 Answered C
    Amazon Athena helps you analyze unstructured, semi-structured, and structured data stored in Amazon S3. Examples include CSV, JSON, or columnar data formats such as Apache Parquet and Apache ORC. You can use Athena to run ad-hoc queries using ANSI SQL, without the need to aggregate or load the data into Athena. It uses Amazon QuickSight for data visualization AWS Glue Data Catalog allows you to create tables and query data in Athena based on a central metadata store available
  21. juanvaliente 👍 1 Answered C
    Es el C sin dudas, las opciones A y D requieren una infraestructura de base de datos separada, lo que puede aumentar los costos operativos. La opción B no es adecuada para este escenario ya que Amazon CloudWatch Logs no admite consultas SQL directamente y puede requerir una transformación adicional de los datos antes de que se puedan analizar.
  22. vietqtran 👍 1 Answered C
    AWS Athena is an interactive data analytics service from Amazon Web Services (AWS) that allows you to run SQL queries directly on data stored in Amazon S3 without having to manage infrastructure. Athena provides a quick and easy way to analyze data in formats such as CSV, JSON, ORC, Parquet, and Avro without having to move data outside of S3.
  23. Ruffyit 👍 1
    Amazon Athena is an interactive query service that makes it easy to analyze data directly in Amazon Simple Storage Service (Amazon S3) using standard SQL. With a few actions in the AWS Management Console, you can point Athena at your data stored in Amazon S3 and begin using standard SQL to run ad-hoc queries and get results in seconds.
  24. envest 👍 1
    IMO: on-demand with least overhead would mean automated serverless (e.g. schedule). Answer A lacks Spectrum, Answer C lacks Glue, but D has all necessary components & services (Glue, Spark, EMR serverless). But for simple log queries it takes a lot of serverless know how thought for big data and not logs. Considering this, I go with D.
  25. psr83 👍 1 Answered C
    Athena analyze unstructured, semi-structured, and structured data stored in Amazon S3. Examples include CSV, JSON, or columnar data formats such as Apache Parquet and Apache ORC. You can use Athena to run ad-hoc queries using ANSI SQL, without the need to aggregate or load the data into Athena.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Scheduled scaling for a predictable morning EC2 traffic spike

S-grade

Improving RDS Performance with Provisioned IOPS SSD

S-grade

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide