AWS CloudTrail Lake cost: per GB ingested and scanned

Quick answer

CloudTrail Lake bills per GB of events ingested into an event data store (with a one-year or extended retention pricing option, and a lower-cost tier for infrequent-access) plus per GB scanned by queries. Cost scales with how many events you ingest and how much data your queries scan, so ingesting only the event types you need, choosing the right retention tier, and writing selective queries are the levers.

AWS CloudTrail Lake stores CloudTrail events in a queryable event data store for auditing and investigation, going beyond the basic CloudTrail trail. Its cost has two parts, ingesting events and querying them, so the volume of events you capture and the breadth of your queries drive the bill.

Ingestion and query

Dimension	Bills for
Ingestion	Per GB of events ingested (by pricing tier)
Query	Per GB of data scanned by queries
Retention	One-year included; extended retention priced

Ingestion bills per gigabyte of events stored, with a standard tier and a lower-cost infrequent-access tier for events you rarely query. Queries bill per gigabyte scanned, like Athena. Retention up to a year is included in the ingestion pricing, with extended retention priced separately. So a high-volume, long-retention, frequently-queried event store costs the most.

What drives the bill

Ingestion volume (how many events, of which types, you capture) and query breadth (how much data each query scans) are the drivers. Capturing management and data events across a large, active environment generates high ingestion, and broad queries over long histories scan a lot. The infrequent-access tier helps for events kept mainly for compliance and rarely queried.

Controlling CloudTrail Lake cost

Ingest only the event types you need for your audit and security use cases (data events in particular can be high-volume), use the infrequent-access tier for events retained for compliance but rarely queried, choose retention to match requirements rather than defaulting to the maximum, and write selective queries that scan narrow time ranges. The ingest-what-you-use and scan-less discipline mirrors Athena and CloudWatch Logs.

FAQ

How is AWS CloudTrail Lake priced?

Per GB of events ingested into an event data store (with a standard tier and a lower-cost infrequent-access tier, and a one-year or extended retention option) plus per GB scanned by queries. Cost scales with how many events you ingest and how much data your queries scan.

How do I reduce CloudTrail Lake cost?

Ingest only the event types you need (data events in particular can be high-volume), use the infrequent-access tier for events retained for compliance but rarely queried, choose retention to match requirements rather than the maximum, and write selective queries that scan narrow time ranges rather than long histories.

What is the infrequent-access tier in CloudTrail Lake?

A lower-cost ingestion tier for events you need to retain but rarely query, typically for compliance. It reduces ingestion cost for those events in exchange for higher query cost when you do scan them, so it suits audit data kept for retention rather than active investigation.

What drives CloudTrail Lake cost?

Ingestion volume, how many events of which types you capture, and query breadth, how much data each query scans. Capturing management and data events across a large, active environment generates high ingestion, and broad queries over long histories scan a lot. Both scale the bill, so scoping ingestion and queries is key.

Is CloudTrail Lake more expensive than a basic trail?

It provides more, a queryable, longer-retention event store versus a basic trail delivering logs to S3, so it costs more for that capability. Whether it is worth it depends on your need for integrated querying and extended retention. For basic log delivery, a standard trail to S3 is cheaper; CloudTrail Lake is for investigation and audit at scale.

Does C3X estimate CloudTrail Lake cost?

CloudTrail Lake cost is driven by event ingestion and query scan volume, which are usage inputs. C3X prices the surrounding infrastructure, and you model event volume and query patterns to estimate the audit-store charges.

What to do next

Estimate the infrastructure around your audit logging before you deploy. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.