A company runs an application on Amazon EC2 instances in an Auto Scaling group. The application writes logs to local storage. After a scale-in event, a security engineer observed that logs were lost. The company must ensure log durability and availability, and retain all logs for at least 1 year for audits. What should the security engineer recommend?

The correct solution is to install and configure the Amazon CloudWatch agent in the AMI. This streams logs to Amazon CloudWatch Logs, providing centralized retention and review. CloudWatch Logs offers durable storage and configurable retention policies (up to indefinitely), satisfying the 1-year audit requirement and ensuring logs are not lost during scale-in events. Adding an EBS volume to each instance would require complex management to reattach volumes to new instances, and logs would still be tied to specific volumes, not a centralized solution. Creating an EFS file system and copying logs daily would introduce a delay in log availability and still risk losing recent logs if an instance terminates before the daily copy. An Auto Scaling lifecycle hook to hold instances for manual review is inefficient, not scalable, and doesn't guarantee log durability or centralized retention.