A company sends AWS WAF logs to Amazon S3 through Amazon Kinesis Data Firehose. An Amazon Athena query runs once per day to retrieve the previous 24 hours of WAF logs. Although daily log volume is stable, the query is taking progressively longer over time. You need to prevent query runtime from continuing to increase while minimizing operational overhead. Which solution meets these requirements?

The correct solution is to modify the Kinesis Data Firehose configuration and Athena table definition to partition the data by date and time, then change the Athena query to view relevant partitions. This is effective because partitioning data in S3 allows Athena to prune partitions, scanning only the data relevant to the query's time range (the last 24 hours). This significantly reduces the amount of data scanned, directly addressing the increasing query runtime without increasing operational overhead. Creating a Lambda function to consolidate logs would still result in large files that Athena would have to scan entirely, not improving performance for time-based queries. Sending logs to a different S3 bucket each day doesn't inherently partition the data in a way Athena can leverage efficiently for time-based queries across multiple "buckets" (which are effectively just prefixes in S3). Using Amazon Redshift and Redshift Spectrum introduces unnecessary complexity and cost for a daily Athena query use case, and Redshift Spectrum still benefits from partitioned data in S3.