Amazon Security Lake Pricing

Yes. You can try Security Lake for 15 days at no cost with any new account to Security Lake with the AWS Free Tier. You will have access to the full set of features during the free trial.

You can enable the service and take advantage of the 15-day free trial. During that period, you can access a usage tab in the Security Lake console that will estimate your usage. Security Lake prices are based on two dimensions: data ingestion and data normalization.

Monthly costs are determined by the volume of log and event data ingested from AWS services per gigabyte. Your data is stored in Amazon S3 and standard Amazon S3 charges apply. Security Lake also orchestrates other AWS services on your behalf. You will incur separate charges for AWS services used and resources set up as part of your security data lake. See pricing for AWS Glue, Amazon EventBridge, AWS Lambda, Amazon SQS, and Amazon SNS. You are responsible for costs that you incur by querying data from Security Lake and storing query results.

Many customers must store extensive volumes of security-related logs to meet compliance mandates while optimizing storage costs and security analytics. With Security Lake, customers can cost-effectively store their security logs in their Amazon S3 account. Security Lake simplifies data management by offering customizable retention setting and automated storage tiering. It automatically partitions and converts incoming security data into a storage and query-efficient Apache Parquet format. Security Lake uses the Apache Iceberg open table format to enhance query performance for your security analytics.

Customers gain flexibility in managing their logs, allowing them to choose which logs to retain for compliance, which logs to send for deeper analysis to their analytics solutions, and which logs to query in place for incident investigation purposes. Security Lake helps the customer retain logs that were previously unfeasible to store and extend storage beyond their typical retention policy within their Security information and event management (SIEM).

No. There is no Security Lake charge for bringing third-party or your own data to centralize in Security Lake. Your data is stored in Amazon S3 and standard Amazon S3 charges apply.

Security Lake charges what you would pay the originating service, plus a conversion fee to normalize logs and events that come from natively-supported AWS services to the OCSF schema and covert to Apache Parquet format ($ 0.035 per GB). For AWS CloudTrail sources, the price is based on data events, which are charged at $0.10 per 100,000 data events delivered. Security Lake offers a comparable pricing, but is based on GB of data instead. Other logs follow the Amazon CloudWatch vended logs pricing.

No, the delegated account in which Security Lake runs is not billed for all accounts. This accounts only incurs the charges of log collection for this account, along with any costs related to the data lake components orchestrated by Security Lake in this account, such as Amazon S3, AWS Lambda, Amazon SQS, AWS Glue, or Amazon EventBridge. Each account can see its own usage on its bill, but the member account bills are for informational purpose only, as the consolidated bill is paid by the organization management account. This billing structure is standard across services that use AWS organization billing consolidation.

No. Security Lake can streamline your existing log collections. By deprecating duplicate copies of AWS CloudTrail or individual VPC Flow Logs, you can offset any costs incurred by Security Lake.