A company uses Amazon Cognito as its OAuth 2.0 identity platform for web and mobile applications. The company must capture both successful and unsuccessful sign-in attempts and be able to query the data. Which solution will meet these requirements?

The correct solution leverages AWS CloudTrail, which records API calls and related events made by or on behalf of an AWS account, including those from Amazon Cognito. CloudTrail logs both successful and unsuccessful sign-in attempts (represented by the InitiateAuth event) and delivers these logs to an Amazon S3 bucket. Amazon Athena can then be used to query these logs directly from S3 using standard SQL, making it efficient to analyze sign-in activity. Incorrect options: Configuring Amazon Cognito to send user activity logs to CloudWatch is not the primary or most comprehensive way to capture all sign-in attempts for querying. CloudWatch Logs would require additional processing and integration with EventBridge and Lambda to export to S3 for Athena, adding complexity. Configuring CloudTrail to send events to CloudWatch for monitoring is useful for real-time alerts but doesn't directly facilitate querying historical data with Athena as efficiently as direct delivery to S3. CloudWatch metrics provide aggregated data, not individual event details, making them unsuitable for querying specific sign-in attempts or their success/failure status.