Amazon Security Lake automatically centralizes security data from AWS environments, SaaS providers, on premises, and cloud sources into a purpose-built data lake stored in your account. With Security Lake, you pay as you go with no upfront costs. Security Lake prices are based on two dimensions: data ingestion and data normalization. Monthly costs are determined by the volume of log and event data ingested from AWS services per gigabyte. There is no charge for bringing third-party or your own data. You pay a separate price depending on the origin of the logs (AWS CloudTrail or other AWS services), plus a data normalization charge. You are required to have a CloudTrail organization trail configured to collect CloudTrail management events into your security data lake. Your data is stored in Amazon Simple Storage Service (Amazon S3) and standard Amazon S3 charges apply. Security Lake also orchestrates other AWS services on your behalf. You will incur separate charges for AWS services used and resources set up as part of your security data lake. See pricing for AWS Glue, Amazon EventBridge, AWS Lambda, Amazon SQS, and Amazon SNS. Standard data transfer costs apply for data accessed or aggregated into Amazon S3 across AWS Regions. You are responsible for costs that you incur by querying data from Security Lake and storing query results.
Free trial
In supported Regions, new Security Lake account holders can try the service free for 15 days and gain access to all its features.
Pricing examples
Example 1: Enabling Security Lake in one Region with a preexisting CloudTrail organization trail
You enter a new billing month for your US East (N. Virginia) deployment. Security Lake has ingested 256 GB of CloudTrail management events, 256 GB of CloudTrail data events (for example, S3 object-level API operations), and 1,024 GB of other AWS security event data (from Amazon VPC Flow Logs, Amazon Route 53 Resolver query logs, or security findings from AWS Security Hub).
Security Lake charges in US East (N. Virginia) would be calculated as follows:
512 GB of CloudTrail logs ingested at $0.75 per GB = 512 * $0.75 = $384.00
1,024 GB of other AWS logs ingested at $0.25 per GB = 1,024 * $0.25 = $256.00
1,536 GB of data normalization charges ingested at $0.035 per GB = 1,536 * $0.035 = $53.76
The total monthly charges for your Security Lake bill will be $693.76.
Example 2: Enabling Security Lake in one Region and creating a new CloudTrail organization trail
In the event that you don’t have a preexisting AWS CloudTrail organization trail for your AWS organization, you must create one before ingesting CloudTrail management events in Security Lake. Deploying an organization trail is a recommended best practice, and AWS provides tooling, such as AWS Control Tower, to migrate your individual account trails to an organization trail. If you choose to deploy a new organization trail for your organization and have preexisting individual account trails, your CloudTrail bill will increase due to the delivery of additional management event copies from the new organization trail.
You enter a new billing month for your US East (N. Virginia) deployment. Security Lake has ingested 256 GB of CloudTrail management events, 256 GB of CloudTrail data events (for example, S3 object-level API operations), and 1,024 GB of other AWS security event data (from Amazon VPC Flow Logs, Amazon Route 53 Resolver query logs, or security findings from AWS Security Hub).
You have existing CloudTrail management usage across your member account trails of 186,991,773 events (which corresponds to the 256 GB volume of management events that you ingest in Security Lake for an average management event size of 1,470 bytes). You receive only one copy of these events in CloudTrail so they do not incur an additional charge (see the AWS Free Tier page).
The total monthly charges for your Security Lake bill will be $693.76 (same as example 1).
The incremental CloudTrail charges in your CloudTrail bill would be calculated as follows:
186,991,773 events delivered as management events copies at $2.00 per 100,000 events = 186,991,773 / 100,000 * $2.00 = $3,739.84
The total additional CloudTrail charges across member accounts will be $3,739.84.
See AWS CloudTrail pricing for more details.
Note: Amazon Security Lake usage is calculated in binary gigabytes, where 1 GB is 2^30 bytes. This unit of measurement is also known as a gibibyte, defined by the International Electrotechnical Commission (IEC). Similarly, 1 TB is 2^40 bytes, which is 1,024 GB.
Additional pricing resources
Easily calculate your monthly costs with AWS
Contact AWS specialists to get a personalized quote