Multiple applications in one account send logs to CloudWatch. A data analytics team must collect application performance and custom metrics, transform them, and store the transformed metrics in S3. Any new metrics added to the CloudWatch namespace must be collected automatically. Which solution has the least operational overhead?

The correct solution leverages a CloudWatch metric stream to capture all metrics, including new ones, with minimal operational overhead. CloudWatch metric streams automatically export all metrics in an account to a destination like Kinesis Data Firehose. Firehose can then invoke a Lambda function for data transformation before delivering the final output to S3. This approach is efficient because it doesn't require manual configuration for new metrics. Option 1 is less optimal because specifying individual application metrics and CloudWatch namespace metrics in the stream is redundant when "all metrics" can be selected, and it might miss newly added metrics if not explicitly included. Option 3 is incorrect because metric filters generate custom metrics from logs, not directly collect existing CloudWatch metrics, and it doesn't address the transformation requirement or automatic collection of new metrics. Option 4 focuses on log groups and subscription filters, which are for logs, not CloudWatch metrics.