A company needs to store and analyze log data from thousands of servers. The logs are timestamped and rarely updated. Queries are mostly time-range aggregations. Which database service is best suited for this workload?
CloudWatch Logs is purpose-built for log ingestion, storage, and analysis.
Why this answer
Amazon CloudWatch Logs is purpose-built for ingesting, storing, and analyzing timestamped log data from distributed sources. It supports real-time and historical time-range aggregations via Logs Insights, which uses a query language optimized for pattern matching and aggregation over time windows. The service automatically handles high-throughput ingestion from thousands of servers and is cost-effective for append-only, rarely updated log data.
Exam trap
The trap here is that candidates often choose DynamoDB or RDS because they are familiar with general-purpose databases, but they overlook that CloudWatch Logs is a fully managed, serverless service specifically designed for log ingestion and time-series analysis, eliminating the need for custom schema design, indexing, or scaling logic.
How to eliminate wrong answers
Option B (Amazon ElastiCache for Redis) is wrong because Redis is an in-memory key-value store designed for low-latency caching and real-time data structures, not for persistent storage or time-range aggregation queries over large volumes of log data; it lacks native log analytics capabilities and would require significant custom development. Option C (Amazon DynamoDB) is wrong because DynamoDB is a NoSQL key-value and document database optimized for point lookups and high-throughput transactional workloads, not for time-series aggregations; it does not support native time-range aggregation queries and would require complex application-level logic and secondary indexes to approximate log analysis. Option D (Amazon RDS for PostgreSQL) is wrong because PostgreSQL is a relational database designed for structured, transactional data with complex joins and ACID compliance; it is not optimized for high-ingest, append-only log workloads and would incur high storage costs and performance bottlenecks under the write load from thousands of servers, and its time-range aggregation queries would be slower than a purpose-built log analytics service.