AWS CloudTrail Lake

aws Monitoringaws-cloudtrail-lake

Immutable audit event data store queried with SQL, 366-day default retention; in maintenance since March 2026.

Provider: aws
Kind: Monitoring
Category: Operations
Official docs: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-manage-costs.html

Properties · 4 set by this component

property	type	values	required	kind default	this component
alertGrouping	boolean	—	no	false	inherited
collectorMode	enum	pull \| push	no	pull	▸ push
eventCategory · component property	enum	cloudtrail-events \| insights-events \| config-items \| audit-manager-evidence \| external-events	no	cloudtrail-events	inherited
federationEnabled · component property	boolean	—	no	false	inherited
independentOfMonitored	boolean	—	no	false	inherited
managed	boolean	—	no	false	▸ true
organizationScope · component property	boolean	—	no	false	inherited
pricingOption · component property	enum	one-year-extendable-retention \| seven-year-retention	no	one-year-extendable-retention	inherited
retentionDays	integer	—	no	—	▸ 366
signal	enum	metrics \| logs \| traces \| alerts \| all	no	metrics	▸ logs

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "cloudtrail-lake", component: "aws-cloudtrail-lake" }

Other Monitoring products · 174

and 134 more → Monitoring page

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# AWS CloudTrail Lake event data store: an immutable, ORC-backed collection of audit events queried with SQL.
3# In maintenance since 31 March 2026 and closed to new customers from 31 May 2026; existing users continue.
4# "Working with AWS CloudTrail Lake" and "Managing CloudTrail Lake costs": One-year extendable retention pricing
5# is the default option with a 366-day default retention (max 3653); all events are encrypted by CloudTrail.
6schemaVersion: "1"
7type: "component"
8id: "aws-cloudtrail-lake"
9kind: "monitoring"
10provider: "aws"
11docs: "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-manage-costs.html"
12defaults:
13  signal: "logs"
14  collectorMode: "push"
15  retentionDays: 366
16  managed: true
17properties:
18  pricingOption:
19    type: "enum"
20    values: ["one-year-extendable-retention", "seven-year-retention"]
21    default: "one-year-extendable-retention"
22  eventCategory:
23    type: "enum"
24    values: ["cloudtrail-events", "insights-events", "config-items", "audit-manager-evidence", "external-events"]
25    default: "cloudtrail-events"
26  organizationScope:
27    type: "boolean"
28    default: false
29  federationEnabled:
30    type: "boolean"
31    default: false

The same page as markdown, for an agent: /catalogue/components/aws-cloudtrail-lake.md