Amazon Security Lake Pricing

During the preview period, there will be no additional charge. After the preview period ends, your account will be eligible to participate in a free trial. In supported Regions, new Security Lake account holders can try the service free for 15 days and gain access to its features. The Security Lake console indicates how many days are left in the free trial and average daily cost (based on volume of data ingested), taking the guesswork out of budget planning.

Start your free trial

Standard S3 charges apply (see Amazon S3 pricing) 

Example 1: Enabling Security Lake in one Region with a preexisting CloudTrail organization trail

You enter a new billing month for your US East (N. Virginia) deployment. Security Lake has ingested 256 GB in CloudTrail management events, 256 GB of CloudTrail data events (for example, S3 object-level API operations) and 1,024 GB of other AWS security event data (from Amazon VPC Flow Logs, Amazon Route 53 Resolver query logs, or security findings from AWS Security Hub).

Security Lake charges in US East (N. Virginia) would be calculated as follows:

512 GB of CloudTrail logs ingested at $0.75 per GB = 512 * $0.75 = $384.00
1,024 GB of other AWS logs ingested at $0.25 per GB = 1024 * $0.25 = $256.00
1,536 GB of data normalization charges ingested at $0.035 per GB = 1536 * $0.035 = $53.76

Total monthly charges for your Security Lake bill would be $693.76

Example 2: Enabling Security Lake in one Region and creating a new CloudTrail organization trail

In the event that you don’t have a preexisting AWS CloudTrail organization trail for your AWS organization, you must create one before ingesting CloudTrail management events in Security Lake. Deploying an organization trail is a recommended best practice, and AWS provides tooling, such as AWS Control Tower, to migrate your individual account trails to an organization trail. If you choose to deploy a new organization trail for your organization and have preexisting individual account trails, your CloudTrail bill will increase due to the delivery of additional management event copies from the new organization trail.

You enter a new billing month for your US East (N. Virginia) deployment. Security Lake has ingested 256 GB in CloudTrail management events, 256 GB of CloudTrail data events (for example, S3 object-level API operations), and 1,024 GB of other AWS security event data (from Amazon VPC Flow Logs, Amazon Route 53 Resolver query logs, or security findings from AWS Security Hub).

You have existing CloudTrail management usage across your member account trails of 186,991,773 events (which corresponds to the 256 GB volume of management events that you ingest in Security Lake for an average management event size of 1,470 bytes). You receive only one copy of these events in CloudTrail so they do not incur an additional charge (see AWS Free Tier).

Total monthly charges for your Amazon Security Lake bill would be $693.76 (same as example 1)

Incremental CloudTrail charges in your CloudTrail bill:

186,991,773 events delivered as management events copies at $2.00 per 100,000 events = 186,991,773 / 100,000 * $2.00 = $3,739.84

Total additional CloudTrail charges across member accounts would be $3,739.84
See AWS CloudTrail pricing for more details.

Note: Amazon Security Lake usage is calculated in binary gigabytes (GB), where 1 GB is 2^30 bytes. This unit of measurement is also known as a gibibyte (GiB), defined by the International Electrotechnical Commission (IEC). Similarly, 1 TB is 2^40 bytes, i.e. 1,024 GBs.