Querying S3 JSON Logs with Minimal Overhead
A company needs the ability to analyze the log files of its proprietary application. The logs are stored in JSON format in an Amazon S3 bucket. Queries will be simple and will run on-demand. A solutions architect needs to perform the analysis with minimal changes to the existing architecture. What should the solutions architect do to meet these requirements with the LEAST amount of operational overhead?
Community Insight
The question tests serverless ad-hoc querying of existing S3 data, and the trap is choosing a heavier service (Redshift load, EMR cluster, CloudWatch storage migration) that adds ingestion steps, infrastructure, or architectural change the scenario explicitly excludes.
Amazon Athena lets you run standard SQL ad-hoc queries directly against JSON log files already stored in Amazon S3, with no data loading, no clusters, and no changes to the existing architecture. This page explains why Athena satisfies the simple, on-demand, least-operational-overhead requirement better than Redshift, CloudWatch Logs, or an EMR Spark cluster.
Option A (Redshift) is the most tempting wrong pick because it is a familiar SQL warehouse, but it forces a full copy of every log file into a cluster you must provision, patch, and pay for continuously — directly violating 'minimal changes' and 'LEAST operational overhead' for simple on-demand queries.
Community Discussion (93 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Amazon Athena is a serverless interactive query service that runs ANSI SQL directly against data that already lives in Amazon S3, including JSON files, so the architect points Athena at the existing bucket and queries run in seconds. Because the logs are already in S3 in JSON format, no extract/load step, no schema migration, and no persistent compute is required, which precisely matches 'minimal changes to the existing architecture.' Athena is on-demand by design: there is no cluster to start or stop, no infrastructure to manage, and billing is per query scanned, so simple sporadic queries cost very little. AWS documentation, quoted in the top comment, states Athena lets you "begin using standard SQL to run ad-hoc queries and get results in seconds." This is the textbook least-operational-overhead answer for ad-hoc S3 analytics.Why the Other Options Are Wrong
Option A requires loading all log content into a Redshift cluster, which means provisioning and maintaining a database, moving data out of its current path, and ongoing cost — a two-step process that is oversized for simple on-demand queries and contradicts minimal architectural change. Option B fails because CloudWatch Logs is an ingestion and retention service, not a SQL engine; there is no console where you run SQL queries over your S3 JSON logs, and moving the logs there would itself be a major architecture change. Option D needs a Glue Data Catalog plus a transient EMR Spark cluster, which introduces job management, IAM and metastore setup, and cluster lifecycle handling — far more operational overhead than a serverless query service for trivial SQL. As andreadhelpra noted, "CloudWatch does not have a console where you can run queries."Community Comment Notes
Community consensus is unanimous on C, with airraid2010, PhucVuu, Guru4Cloud, cookieMr, and others all selecting it. PhucVuu keyed on "Queries will be simple and will run on-demand" and warned that Redshift becomes relevant only "for complex query we will apply Redshit [Redshift]." Guru4Cloud emphasized that "there is no need for data transformation or loading into another service" because Athena reads the S3 JSON directly. andreadhelpra added that "The data is not complex so Redshift and EMR are a overhead or simply not suitable," reinforcing the operational-overhead framing of the question.Official Reference
Exam Strategy
On SAA-C03, treat 'least operational overhead' plus 'existing data in S3' plus 'simple ad-hoc SQL' as a signal for the serverless option (Athena) rather than a provisioned cluster. Eliminate any answer that requires copying data into a new service before you can query it.
Frequently Asked Questions
Why not use Amazon Redshift to query the JSON logs in S3?
Redshift requires loading the logs into a provisioned cluster you must create, scale, and patch, adding cost and steps. For simple on-demand queries, Athena's serverless in-place SQL is far lower overhead.
Can Amazon CloudWatch Logs run SQL queries on S3 log files?
No. CloudWatch Logs is for log ingestion, storage, and metric filters/insights on its own log groups; it cannot run ANSI SQL against an S3 bucket, so it fails both the query and minimal-change requirements.
Related Analysis
Practice All SAA-C03 Questions
Access 120 questions with complete answers and detailed explanations.
View Full SAA-C03 Practice Test →