Question #572
A company is using Amazon OpenSearch Service to store and analyze application logs. The company ingests logs into an OpenSearch Service cluster with 12 data nodes from an Amazon S3 bucket that uses S3 Standard-Infrequent Access (S3 Standard-IA). The logs remain in the cluster for 6 months for analysis, after which the company deletes the indexes. Compliance regulations require the company to retain all logs for 5 years. The company wants to minimize costs while meeting compliance requirements.
Which solution will meet these requirements MOST cost-effectively?
Replace all data nodes with UltraWarm nodes to handle the logging workload. Transition the input logs from S3 Standard-IA to S3 Glacier Deep Archive immediately upon ingestion into the cluster.
Reduce the number of data nodes in the cluster to 3. Add UltraWarm nodes to handle the logging workload. Configure indexes to transition to UltraWarm during ingestion. Apply an S3 Lifecycle policy to transition the input logs to S3 Glacier Deep Archive 6 months after ingestion.
Reduce the number of data nodes in the cluster to 3. Use instance-backed storage for the remaining data nodes. Transition the input logs from S3 Standard-IA to S3 Glacier Deep Archive immediately upon ingestion into the cluster.
Reduce the number of data nodes in the cluster to 3. Add UltraWarm nodes and cold storage nodes to the cluster. Configure indexes to transition from UltraWarm to cold storage after 6 months. Delete the input logs from S3 using an S3 Lifecycle policy after 6 months.
Explanation
Option B is correct because:
1. Cost Reduction: Reducing data nodes from 12 to 3 lowers compute costs.
2. UltraWarm Nodes: Adding UltraWarm nodes allows cost-effective storage for the 6-month analysis period, as UltraWarm is optimized for log analytics with lower storage costs.
3. S3 Lifecycle Policy: Transitioning logs to S3 Glacier Deep Archive after 6 months meets the 5-year retention requirement at minimal cost, as Glacier Deep Archive is the cheapest storage class for long-term retention.
Other options fail because:
- A: Moving logs to Glacier immediately disrupts the 6-month analysis period. UltraWarm cannot replace all data nodes.
- C: Instance-backed storage is less cost-effective than UltraWarm. Moving logs to Glacier immediately prevents analysis.
- D: Deleting logs from S3 violates compliance. Cold storage nodes are unnecessary since S3 Glacier handles long-term retention.
Key Points: Use UltraWarm for cost-effective analytics, S3 lifecycle policies for archival, and minimize data nodes to reduce compute costs.
Answer
The correct answer is: B