Amazon S3 with Amazon CloudFront:
Amazon S3 provides highly scalable and durable storage for petabytes of data.
Amazon CloudFront, as a content delivery network (CDN), caches frequently accessed data at edge locations to reduce latency. This combination is ideal for storing and accessing engineering drawings.
Incorrect Options Analysis:
Option B: Amazon S3 Glacier Deep Archive is for long-term archival storage, not frequent access.
Option C: Amazon EBS is unsuitable for large-scale, multi-user data access and does not support caching directly.
Option D: AWS Storage Gateway is for hybrid cloud storage, which is unnecessary for a fully cloud-based architecture.
References:
Amazon S3
Amazon CloudFront

Amazon S3 Storage Lens with advanced activity metrics is the most operationally efficient answer because AWS documentation explicitly says you can use S3 Storage Lens advanced metrics to identify "cold" buckets, meaning buckets whose objects are no longer accessed or are accessed only rarely. That is exactly the requirement in the question. This avoids building a custom analytics workflow on top of CloudTrail or CloudWatch metrics. The standard S3 console does not provide the same purpose-built fleet-level analysis for cold-bucket identification. Athena and CloudTrail can be used for access analysis, but they require more setup, data handling, and query maintenance. S3 Storage Lens is the native managed feature for this storage- optimization scenario. (AWS Documentation)

* A. EventBridge rule: Triggers an event whenever there is a change in CloudFront distribution, ensuring real-time monitoring.
* B. ALB with WAF: Focuses on application-level security, not CloudFront logging.
* C. Lambda + SNS: Provides notifications upon detection of changes in logging configuration.
* D. GuardDuty: Monitors anomalies but does not specifically address CloudFront logging changes.
* E. Private API + WAF: Irrelevant to CloudFront logging changes.
References: Amazon EventBridge, AWS Lambda

AWSSecrets Managercan integrate directly with Amazon RDS for automatic and seamless password rotation.
Secrets Manager handles the complexity of password management, including generating strong passwords and rotating them at a defined interval (e.g., every 30 days). It also automatically updates the connection information for RDS, minimizing operational overhead.
Option A (Lambda with EventBridge): While possible, this requires custom coding and operational management of Lambda, which introduces additional complexity.
Option B (Manual password change): Using the modify-db-instance command requires manual intervention and is not automated, leading to more operational effort.
Option D (Parameter Store): Systems Manager Parameter Store is less specialized for password management than Secrets Manager and does not have built-in automated rotation for RDS credentials.
AWS References:
AWS Secrets Manager Rotation for RDS

Amazon CloudFront is a content delivery network (CDN) service that distributes content with low latency and high transfer speeds. Placing CloudFront in front of the S3 bucket ensures globalusers download content from the nearest edge location, reducing latency significantly.
Reference: AWS Documentation - Amazon CloudFront with S3 Origin