A company has deployed a web application on AWS. The web application uses an Application Load Balancer (ALB) across multiple Availability Zones. The…

Application Load Balancer (ALB) access logs capture detailed information about requests and are delivered to a specified Amazon S3 bucket, not directly to Amazon CloudWatch Logs. The first step after enabling logging is to configure this S3 bucket destination. Once the logs are populated in S3, Amazon Athena is the recommended and most efficient service for running interactive, ad-hoc SQL queries on this data. By creating a table in Athena that maps to the log data in S3, the network engineer can query for specific HTTP status codes (e.g., 4xx, 5xx), target processing times, and other fields to identify the source of the errors reported by users.

A. ALBs do not send access logs directly to Amazon CloudWatch Logs. The primary and direct destination for ALB access logs is an Amazon S3 bucket.

C. Amazon CloudWatch Logs does not automatically pull ALB access logs from an S3 bucket. This would require a custom data ingestion process.

D. This option is incorrect because the premise—sending logs directly to CloudWatch Logs—is false for ALB access logs. The Athena CloudWatch Connector is for querying logs already in CloudWatch.

1. AWS Documentation: Elastic Load Balancing User Guide. "Access logs for your Application Load Balancer". This document states, "After you enable access logging for your load balancer, Elastic Load Balancing captures the logs and stores them in the Amazon S3 bucket that you specify as compressed files." It also has a dedicated section on using Amazon Athena for analysis. (See section: "Querying Application Load Balancer logs").

2. AWS Documentation: Amazon Athena User Guide. "Querying Application Load Balancer Logs". This guide provides a step-by-step tutorial on how to create a table in Athena to query ALB logs stored in Amazon S3. It explicitly states, "You can use Amazon Athena to query your Application Load Balancer access logs." (See section: "To create the table for ALB logs").

3. AWS Documentation: Elastic Load Balancing User Guide. "Enable access logging". This section details the configuration steps, which require specifying an S3 bucket. It makes no mention of CloudWatch Logs as a destination option for access logs. (See section: "Enable access logging").