A company is deploying an Amazon ECS cluster that will run multiple services behind an Application Load Balancer (ALB) using multiple target groups. A DevOps engineer must collect both application logs and ALB access logs and deliver them to an Amazon S3 bucket for near-real-time analysis. Which combination of actions should the engineer take? (Choose three.)

To collect application logs, setting the ECS task definition logging driver to awslogs directs container logs to CloudWatch Logs. For near-real-time analysis in S3, a CloudWatch Logs subscription filter can forward these logs to an Amazon Kinesis Data Firehose delivery stream, which then delivers them to the S3 bucket. For ALB access logs, enabling access logging directly on the ALB and configuring it to deliver logs to the S3 bucket is the most straightforward and efficient method. Incorrect options: Downloading and running a CloudWatch Logs container is an overly complex and less integrated approach compared to using the awslogs driver. Using EventBridge and Lambda to call create-export-task is not near-real-time; it's a batch export process. ECS target groups do not have an access logging feature that delivers logs directly to S3; ALB access logs cover this requirement.