A company must capture AWS CloudTrail data events and must retain the logs for 7 years. The logs must be immutable and must be available to be…

AWS CloudTrail Lake is a managed security and audit data lake designed specifically for this use case. It allows for the aggregation, immutable storage, and analysis of activity data. It meets all requirements cost-effectively: it can capture data events, retain them for up to 10 years (3650 days), and the data stored is immutable by design. It includes a SQL-based query engine for complex analysis and integrated dashboards for visualization. As a single, serverless service, it eliminates the operational overhead and cost of managing separate storage, processing, and visualization services, making it the most cost-effective solution.

B. The CloudTrail Event History feature only retains events for the last 90 days, which does not meet the 7-year retention requirement.

C. This solution is technically viable but not the most cost-effective. A persistent Amazon EMR cluster incurs continuous costs, and managing a multi-service pipeline adds significant operational overhead.

D. This architecture is more complex and costly than CloudTrail Lake. It involves data transfer costs and the continuous expense of an Amazon OpenSearch Service domain, even with cold storage.

1. AWS CloudTrail User Guide, "Working with AWS CloudTrail Lake": "CloudTrail Lake event data stores are immutable. This means that events can't be changed after they're ingested." This document also states, "You can configure your event data store to keep your event data for up to 3,650 days (about 10 years)."

2. AWS CloudTrail User Guide, "Querying with AWS CloudTrail Lake": "You can run SQL-based queries on your events in the CloudTrail Lake." This confirms the capability for complex queries.

3. AWS CloudTrail User Guide, "Create and manage dashboards in AWS CloudTrail Lake": This section details the integrated visualization capabilities, stating "You can create dashboards to visualize the data in your event data stores."

4. AWS CloudTrail User Guide, "Viewing events with CloudTrail Event history": "Event history is limited to the past 90 days of events in an AWS Region." This confirms that option B is incorrect due to the retention limit.

5. AWS CloudTrail Pricing: The pricing model for CloudTrail Lake is pay-as-you-go for ingestion and query scanning, which is typically more cost-effective for this use case than provisioning and managing persistent clusters like EMR (Option C) or OpenSearch (Option D).