Publish SES event logs to S3 through Data Firehose and query them with Athena

SAP-C02 By islever Editorial Last updated

Determine a strategy to improve overall operational excellence. Design a strategy to meet reliability requirements. Determine a strategy to improve reliability.

Short answer

AC Send SES event logs to S3 through Data Firehose and query them with Amazon Athena.

Question

A travel company built a web application that uses Amazon Simple Email Service (Amazon SES) to send email notifications to users. The company needs to enable logging to help troubleshoot email delivery issues. The company also needs the ability to do searches that are based on recipient, subject, and time sent. Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)
  1. Create an Amazon SES configuration set with Amazon Data Firehose as the destination. Choose to send logs to an Amazon S3 bucket. Correct Answer
  2. Enable AWS CloudTrail logging. Specify an Amazon S3 bucket as the destination for the logs.
  3. Use Amazon Athena to query the logs in the Amazon S3 bucket for recipient, subject, and time sent. Correct Answer
  4. Create an Amazon CloudWatch log group. Configure Amazon SES to send logs to the log group.
  5. Use Amazon Athena to query the logs in Amazon CloudWatch for recipient, subject, and time sent.

Key Takeaways

An SES configuration set publishes email sending event data to a destination, Amazon Data Firehose is a supported destination that delivers to S3, and Athena can query those S3 logs directly without loading them into a database.

A travel company sends notifications through Amazon SES and needs logging to troubleshoot delivery, plus the ability to search the logs by recipient, subject, and time sent. The logs need to be retained in a queryable store.

Common mistake: Sending SES logs to CloudWatch Logs and querying with Athena. Athena queries data in S3, and CloudWatch Logs stores log events in its own indexed store, so the Athena path requires the logs to land in S3, which is why the Firehose-to-S3 configuration set is the required first step.

Expert Analysis

Why the Answer Is Correct

Creating an SES configuration set with Amazon Data Firehose as the destination causes SES to publish email sending event data, including delivery, bounce, and complaint events, and Firehose delivers that data into an S3 bucket where it is retained durably. Amazon Athena then queries the log data in S3 using standard SQL, so the team can filter by recipient, subject, and time sent to troubleshoot a specific message, and no data warehouse or log analytics service needs to be provisioned or operated.

Why the Other Options Are Wrong

B: AWS CloudTrail records API calls made to AWS services, not the email sending events for each SES message, so it does not produce per-message delivery logs with recipient and subject. D: Sending SES event data to a CloudWatch log group is a supported configuration set destination, but Amazon Athena does not query CloudWatch Logs. E: Athena queries S3, so combining a CloudWatch log group destination with Athena is internally inconsistent and cannot work. That leaves the Firehose to S3 path in A paired with the Athena queries in C.

Community Comment Notes

The community voted 80 to 0 in favour of A and C, and one commenter linked the SES documentation on adding Firehose as an event destination while another linked the Athena guide for querying SES logs, which independently confirms both halves of the pair.

Official Reference

https://docs.aws.amazon.com/ses/latest/dg/event-publishing-add-event-destination-firehose.html

This link opens the official vendor documentation in a new tab.

Community Votes

AC
100%

100% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. liuliangzhou 👍 4
    A. Amazon Data Firehose is configured as the target of SES configuration set, which can capture and transfer SES log data in real-time to Amazon S3 storage buckets. B. CloudTrail is primarily used to track AWS management operations, rather than service level operation logs. C. Amazon Athena allows you to directly analyze data stored in Amazon S3 using SQL queries. D. Amazon SES does not directly support sending logs to CloudWatch. E. Athena does not support directly querying logs in CloudWatch.
  2. G4Exams 👍 3
    A & C. Cloudtrail does not track the emails.
  3. JoeTromundo 👍 2
    A: An Amazon SES configuration set allows you to capture event data related to email sending, such as delivery status, bounces, and complaints. By setting Amazon Kinesis Data Firehose as the destination, you can stream these logs to an Amazon S3 bucket. C: Once the logs are in the S3 bucket, Amazon Athena allows you to run SQL queries directly on the data stored in S3. This enables easy searching and filtering by recipient, subject, and time sent, without having to move or load the data into a database. B: CloudTrail logs API calls to Amazon SES but does NOT provide detailed information about email delivery, bounces, or complaints. D: While you can monitor metrics in CloudWatch, it’s not a good fit for storing or searching detailed SES email logs. E: CloudWatch logs are not natively queryable using Athena.
  4. neta1o 👍 2
    The answers seem pretty split on this. Based on this https://docs.aws.amazon.com/athena/latest/ug/querying-ses-logs.html I'd go A/C
  5. [Removed] 👍 2
    https://aws.amazon.com/blogs/messaging-and-targeting/how-to-log-amazon-ses-details-using-amazon-cloudwatch/
Show 4 more comments
  1. AzureDP900 👍 1
    A,C By creating a configuration set with Data Firehose as the destination (A), the SES logs will be stored in an S3 bucket. Then, using Athena (C) allows you to query those logs for specific information, such as recipient, subject, and time sent
  2. jopaca1216 👍 1
    Just It. https://docs.aws.amazon.com/ses/latest/dg/event-publishing-add-event-destination-firehose.html
  3. vip2 👍 1
    Athena can not direct query Cloudwatch log, so C is correct instead of E.
  4. Russs99 👍 4
    A & C is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Modernize centralized firewall appliances with a Gateway Load Balancer and Auto Scaling

S-grade

Use Lambda over a CloudWatch Logs stream to count unique users per client

S-grade

Serve global game assets with Route 53 latency records and health checks

S-grade

Reach a cross-account S3 data lake through a gateway endpoint and an access point bucket policy

S-grade

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide