A CloudTrail Lake investigation can answer a hard incident question in minutes, but CloudTrail Lake costs can also become a large fixed line item. They depend far more on what you collect than on the number of queries your analysts run.
Security teams need to price real event volume and preserve high-value event history and API activity as evidence. With pay-as-you-go pricing, variable collection volume can become a recurring expense.
Key Takeaways
- CloudTrail Lake pricing has three main components: data ingestion, data retention, and query scanning. Ingestion is usually the largest cost driver because AWS measures event data using its uncompressed size.
- As of August 2026, the one-year extendable option charges $0.75 per GB for CloudTrail events and $0.50 per GB for other supported sources, with retention after the first year costing $0.023 per GB per month.
- Seven-year retention uses tiered ingestion pricing of $2.50 per GB for the first 5 TB, $1.00 per GB for the next 20 TB, and $0.50 per GB above 25 TB. Compare the blended rate against the one-year option rather than evaluating only the lowest tier.
- Estimate costs from measured, uncompressed event volume and realistic query scans—not API call counts or compressed S3 archive size. Advanced event selectors, scoped data collection, and duplicate-collection reviews are the most effective cost controls.
- A layered architecture can use CloudTrail Lake for curated, searchable security evidence and Amazon S3 for broader, lower-cost archival retention. Validate forecasts with AWS Cost Explorer and keep free trial or AWS Free Tier allowances separate from the production budget.
How AWS CloudTrail Lake pricing works in 2026
CloudTrail Lake bills each event data store for three components: data ingestion, data retention, and query scanning. AWS measures ingestion using uncompressed data written to an event data store.
As of August 2026, the one-year option provides extendable retention and charges $0.75 per GB for CloudTrail management events, data events, and network activity events. The applicable rate is $0.50 per GB for other supported sources, including imported historical CloudTrail logs, AWS Config configuration items, and non-AWS auditable data.
Retention pricing includes the first year of storage under the one-year option. After that, retained data costs $0.023 per GB each month. Query analysis costs $0.005 per GB scanned, so a tightly scoped investigation query usually costs little compared with ingestion. For budgeting, separate ingestion from later retention pricing charges.
The AWS CloudTrail pricing page is the source of record for rate changes and regional availability. The AWS Free Tier doesn’t replace these published rates; validate rates and regional availability against the billing region and your AWS account before approving a production budget.
Ingesting every available data event is usually the largest cost driver. Query charges matter, but selective collection controls the bill.
Retention pricing: one-year extendable or seven-year
Retention pricing is set for each event data store. Its data retention policy should follow that dataset, not a general preference across AWS Organizations.
These retention pricing options apply to each event data store:
| Pricing option | Ingestion price | Included retention | Extended retention | Best fit |
|---|---|---|---|---|
| One-year extendable retention | $0.75 per GB for CloudTrail events, including management events, data events, and network activity events; $0.50 per GB for other sources | First year | $0.023 per GB per month, up to 3,653 days | Focused security telemetry and lower monthly ingestion |
| Seven-year retention | $2.50 per GB for first 5 TB, $1.00 per GB for next 20 TB, $0.50 per GB above 25 TB | Seven years | Not available beyond seven years | High-volume datasets with long retention requirements |
The seven-year retention option has a maximum retention period of 2,557 days. AWS documents this limit in its CloudTrail Lake retention guidance.
For monthly intake below 25 TB, retention pricing for one-year extendable retention often gives security teams better control. Extendable retention is a practical choice for lower-volume sources, including data events from sensitive storage buckets, production identity activity, or short-lived incident evidence.
Seven-year retention makes more sense when policy requires seven years and monthly intake is large enough to reach the lower tiers. For this option, retention pricing should use the blended rate rather than the final tier alone. Above 25 TB per month, each additional GB costs $0.50 for ingestion. However, with seven-year retention, the first 25 TB still uses the higher tiers, so assess the blended rate rather than looking only at the final tier.
With extendable retention, an event data store calculates data retention from event time, not the import date. Importing older logs from Amazon S3 may therefore provide less useful event history than expected.
Estimate CloudTrail Lake costs from event volume
Begin with a measured sample rather than API call counts. The same number of events can produce sharply different volumes because event payloads vary by service, resource type, and selector scope. Measure management events, data events, event history, and API activity separately where possible.
Use this data ingestion planning formula for each event data store:
Monthly GB ingested = daily captured events x average uncompressed bytes per event x days in month / 1,073,741,824
Apply event selector inclusion rates before estimating the volume written to each event data store. This adjusts for sampled events you plan to exclude. Then calculate ingestion, query scans, and older cohorts separately for retention pricing.
A one-year example with extendable retention
Assume US East (N. Virginia), a 30-day month, USD prices, and 1 TB equals 1,024 GB. A security team captures 1.5 TB, or 1,536 GB, of management activity, data events, and network activity.
Analysts scan 600 GB through CloudTrail Lake queries.
The estimated first-month bill is:
- Ingestion: 1,536 GB x $0.75 = $1,152
- Query analysis: 600 GB x $0.005 = $3
- First-year retention: $0, because it is included
The estimated monthly total is $1,155. Use AWS Cost Explorer to validate the estimate against actual billing after charges post. This example excludes taxes, AWS Support, data transfer, storage charges, CloudWatch Logs, CloudTrail Insights, imports, and retention beyond the first year.
If the team keeps that full 1,536 GB cohort after its included year ends, it adds $35.33 per month in retention charges. In a steady environment, several older monthly cohorts may be subject to that charge at the same time.
Price historical S3 imports by decompressed size
Do not estimate an import from the size of compressed .gz CloudTrail files in Amazon S3. AWS bills on uncompressed data after decompression, not compressed data in the archive. Compression varies across services and accounts, so a generic ratio produces a weak forecast.
Instead, inventory the actual archive, decompress representative partitions, and calculate total uncompressed data. For a high-stakes archive import, process every object or use a verified batch measurement. The CloudTrail Lake cost management documentation confirms this billing basis.
CloudTrail Lake versus CloudTrail trails, Amazon S3, and Amazon Athena
Traditional CloudTrail trails and CloudTrail Lake solve different problems. A trail delivers logs, usually to Amazon S3, while CloudTrail Lake stores selected data in a managed event data store designed for SQL-based investigation.
The first copy of management events delivered by a trail to Amazon S3 is free. Extra copies of management events, data events, network activity events, and CloudTrail Insights can create CloudTrail charges. Duplicate trails also multiply S3 storage, request, encryption, and downstream analysis costs.
| Architecture | Main cost pattern | Security team trade-off |
|---|---|---|
| Lake | Per-GB ingestion, retention pricing, and $0.005 per GB scanned in its event data store | Fast managed investigation with higher ingestion costs |
| Trail to Amazon S3 | Amazon S3 storage and requests, plus CloudTrail charges where applicable for management events and data events | Low-cost archive, but query design and data management fall to your team |
| Trail to S3 with Athena | S3 costs plus Athena bytes scanned | Flexible analysis, but unpartitioned JSON searches can become expensive |
Lake is usually the stronger choice for curated security evidence that analysts query during incidents and audits. S3 remains useful for broad, lower-cost archival retention. Many teams use both: a central organization trail managed through AWS Organizations for durable raw audit logs, plus smaller Lake event data stores for high-value investigation datasets.
CloudTrail Lake costs should therefore be compared with the full operating model, including CloudTrail pricing, S3, and Athena, not only S3 storage per GB. Include query scans, Glue or table maintenance where used, lifecycle transitions, retrieval fees, log storage costs, staff time, and retention pricing. Compare data retention policies too, since S3 may support seven-year retention while Lake can offer extendable retention for active investigations.
Reduce data ingestion without weakening investigations
The most effective controls start before data ingestion reaches a scoped CloudTrail Lake store. Use advanced event selectors to include data events only for regulated or high-risk resources. For example, retain Amazon S3 object activity for sensitive buckets, not every bucket in every development account. This supports compliance monitoring while keeping collection volume tied to a defined investigation objective.
Management events need discipline, because noisy read-only management events can overwhelm a store for privilege changes, access denials, and configuration actions. Keep data events focused on resources whose audit logs capture critical API activity; test exclusions against detection requirements before organization-wide deployment.
A practical monthly cost optimization control loop has four parts:
- Review event data store volume by account, event category, and selector scope.
- Compare the current month with the previous three months, then investigate sharp changes.
- Check for new member accounts, duplicated organization collection, or expanded advanced event selectors for S3 and Lambda resources.
- Tune selectors for cost optimization, confirm the detection objective, and document the security rationale and approving owner.
Use AWS Cost Explorer’s CloudTrail usage guidance to review service charges and usage types, separating CloudTrail pricing, CloudTrail Insights charges, and log storage costs from ingestion anomalies. Set an AWS Budget and a CloudTrail-focused Cost Anomaly Detection monitor so unexpected ingestion appears before month-end. Treat AWS Free Tier allowances as a reference, not the production budget baseline.
Duplicate collection is common in multi-account environments, especially when an AWS Organizations environment uses an organization-level collector alongside account-level collectors. Each CloudTrail Lake event data store may ingest the same source data for a different team, while downstream destinations such as CloudWatch Logs may duplicate it. Keep an inventory mapping each source to its required data retention, applicable retention pricing, extendable retention needs, store, and collection owner.
CloudTrail Lake free trial and query planning
AWS offers a 30-day CloudTrail Lake free trial with up to 5 GB of ingested data. The limit helps test selectors, query syntax, and event coverage. It is too small to model a production organization that records active data events. Normal production usage is billed separately.
Free trial versus AWS Free Tier
This trial is separate from the AWS Free Tier. Verify current AWS Free Tier eligibility and terms before relying on this allowance.
Query forecasting is straightforward. Under the same US East, 30-day, USD, and GB assumptions used above, a 200 GB CloudTrail Lake query costs $1.00 at $0.005 per GB scanned. This pay-as-you-go pricing example excludes ingestion, imports, taxes, and other AWS services. Keep forecasts separate from data retention, retention pricing, and extendable retention assumptions.
Keep recurring detections narrow. Filter by time range, account, event source, and resource identifiers before scanning a large event data store. Save broad searches for incident response, threat hunting, and audit work that needs the full event history.
Frequently Asked Questions
What is the largest CloudTrail Lake cost driver?
Data ingestion is usually the largest cost driver, especially when teams collect broad data events across many accounts and resources. AWS measures ingestion using the uncompressed data written to the event data store.
How much do CloudTrail Lake queries cost?
Query analysis costs $0.005 per GB scanned under the pricing described in the article. A query scanning 200 GB would therefore cost $1.00, excluding ingestion, retention, taxes, and other AWS services.
Should I choose one-year extendable or seven-year retention?
One-year extendable retention is often better for lower-volume or focused security datasets because the first year is included and later retention costs $0.023 per GB per month. Seven-year retention may be more suitable when policy requires seven years and monthly intake is large enough to benefit from its tiered pricing.
How are historical CloudTrail Lake imports priced?
Historical imports from Amazon S3 are priced using the uncompressed data size after decompression, not the compressed size of .gz files. Measure representative or complete archive partitions before approving an import budget.
How can I reduce CloudTrail Lake costs without weakening investigations?
Use advanced event selectors to collect data events only for regulated or high-risk resources, and review event-store volume by account, category, and selector scope. Also check for duplicate organization and account-level collection, then use AWS Cost Explorer, AWS Budgets, and anomaly monitoring to identify unexpected ingestion.
Final cost decision
AWS CloudTrail Lake pricing is most predictable when you evaluate captured volume, data retention, and realistic query scans together. Review retention pricing against the required evidence window, not just captured volume. Use retention pricing to compare extendable retention with seven-year retention for long-term requirements.
A layered model can place selected data events in a CloudTrail Lake event data store, with Amazon S3 for broad archives. Use AWS Cost Explorer to validate the budget, and exclude optional CloudTrail Insights charges from the base estimate.
Separate AWS Free Tier allowances from the steady-state production forecast. This supports cost optimization while keeping audit logs searchable and preserving the event history investigators need.
