Correct answer - "CloudWatch log expiration policies" : By default, logs are kept indefinitely
and never expire. You can adjust the retention policy for each log group, keeping the indefinite
retention, or choosing a retention period between one day to ten years.
Incorrect:
"AWS Lambda with a CloudWatch Event" - You can create a scheduled task that calls lambda and then
programmatically deletes the logs but why go through that trouble when an easier option is
available
"CloudWatch S3 exporter" - There is no tool named this but even if you transferred over to S3 it
may not meet compliance because you will still have a copy of the logs somewhere else
"CloudWatch Log Streams" - It will not meet compliance because it will still be stored in
CloudWatch