A company’s security team requests that VPC Flow Logs be captured. The logs will be frequently accessed for 90 days, then accessed only intermittently afterward. How should a solutions architect configure the logs to meet these requirements?

The most cost-effective and scalable solution is to use Amazon S3 as the target for VPC Flow Logs. S3 Lifecycle policies allow automatic transition of objects to lower-cost storage classes based on age. After 90 days of frequent access, transitioning logs to S3 Standard-Infrequent Access (S3 Standard-IA) aligns perfectly with the requirement for intermittent access, as S3 Standard-IA is designed for data accessed less frequently but requiring rapid access when needed. Using Amazon CloudWatch with a 90-day expiration would delete the logs, not retain them for intermittent access. Amazon Kinesis is a streaming data service, not a long-term storage solution for flow logs. AWS CloudTrail records API calls and events, not VPC Flow Logs.