---
id: "aws-cloudtrail-lake"
type: "component"
kind: "monitoring"
provider: "aws"
category: "ops"
docs: "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-manage-costs.html"
url: "https://localhost:3000/catalogue/components/aws-cloudtrail-lake"
---

# AWS CloudTrail Lake

Immutable audit event data store queried with SQL, 366-day default retention; in maintenance since March 2026.

| | |
|---|---|
| Provider | [aws](https://localhost:3000/catalogue?provider=aws) |
| Kind | [Monitoring](https://localhost:3000/catalogue/kinds/monitoring) |
| Category | Operations |
| Official docs | [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-manage-costs.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-manage-costs.html) |

## Properties

| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| `alertGrouping` | boolean | — | no | false | inherited |
| `collectorMode` | enum | `pull`, `push` | no | "pull" | **"push"** |
| `eventCategory` | enum | `cloudtrail-events`, `insights-events`, `config-items`, `audit-manager-evidence`, `external-events` | no | "cloudtrail-events" | inherited |
| `federationEnabled` | boolean | — | no | false | inherited |
| `independentOfMonitored` | boolean | — | no | false | inherited |
| `managed` | boolean | — | no | false | **true** |
| `organizationScope` | boolean | — | no | false | inherited |
| `pricingOption` | enum | `one-year-extendable-retention`, `seven-year-retention` | no | "one-year-extendable-retention" | inherited |
| `retentionDays` | integer | — | no | — | **366** |
| `signal` | enum | `metrics`, `logs`, `traces`, `alerts`, `all` | no | "metrics" | **"logs"** |

Bold values are the ones this component pins.

## Rules that apply · 0

No rule selects this kind or its category.

## Other products of the same kind · 174

- [ActionTrail](https://localhost:3000/catalogue/components/alibaba-actiontrail.md) `alibaba-actiontrail` — alibabacloud
- [Application Real-Time Monitoring Service](https://localhost:3000/catalogue/components/alibaba-arms.md) `alibaba-arms` — alibabacloud
- [CloudMonitor](https://localhost:3000/catalogue/components/alibaba-cloud-monitor.md) `alibaba-cloud-monitor` — alibabacloud
- [Database Autonomy Service](https://localhost:3000/catalogue/components/alibaba-das.md) `alibaba-das` — alibabacloud
- [Simple Log Service](https://localhost:3000/catalogue/components/alibaba-log-service.md) `alibaba-log-service` — alibabacloud
- [Security Center](https://localhost:3000/catalogue/components/alibaba-security-center.md) `alibaba-security-center` — alibabacloud
- [Amazon CloudWatch investigations](https://localhost:3000/catalogue/components/aws-aiops.md) `aws-aiops` — aws
- [AWS Audit Manager](https://localhost:3000/catalogue/components/aws-audit-manager.md) `aws-audit-manager` — aws
- [AWS CloudTrail](https://localhost:3000/catalogue/components/aws-cloudtrail.md) `aws-cloudtrail` — aws
- [Amazon CloudWatch Application Insights](https://localhost:3000/catalogue/components/aws-cloudwatch-application-insights.md) `aws-cloudwatch-application-insights` — aws
- [Amazon CloudWatch Application Signals](https://localhost:3000/catalogue/components/aws-cloudwatch-application-signals.md) `aws-cloudwatch-application-signals` — aws
- [Amazon CloudWatch Internet Monitor](https://localhost:3000/catalogue/components/aws-cloudwatch-internet-monitor.md) `aws-cloudwatch-internet-monitor` — aws
- [Amazon CloudWatch Logs](https://localhost:3000/catalogue/components/aws-cloudwatch-logs.md) `aws-cloudwatch-logs` — aws
- [Amazon CloudWatch Network Flow Monitor](https://localhost:3000/catalogue/components/aws-cloudwatch-network-flow-monitor.md) `aws-cloudwatch-network-flow-monitor` — aws
- [Amazon CloudWatch Network Monitor](https://localhost:3000/catalogue/components/aws-cloudwatch-network-monitor.md) `aws-cloudwatch-network-monitor` — aws
- [Amazon CloudWatch RUM](https://localhost:3000/catalogue/components/aws-cloudwatch-rum.md) `aws-cloudwatch-rum` — aws
- [Amazon CloudWatch Synthetics](https://localhost:3000/catalogue/components/aws-cloudwatch-synthetics.md) `aws-cloudwatch-synthetics` — aws
- [Amazon CodeGuru Profiler](https://localhost:3000/catalogue/components/aws-codeguru-profiler.md) `aws-codeguru-profiler` — aws
- [AWS Compute Optimizer](https://localhost:3000/catalogue/components/aws-compute-optimizer.md) `aws-compute-optimizer` — aws
- [Amazon Detective](https://localhost:3000/catalogue/components/aws-detective.md) `aws-detective` — aws
- [Amazon DevOps Guru](https://localhost:3000/catalogue/components/aws-devops-guru.md) `aws-devops-guru` — aws
- [Amazon GuardDuty](https://localhost:3000/catalogue/components/aws-guardduty.md) `aws-guardduty` — aws
- [Amazon Inspector](https://localhost:3000/catalogue/components/aws-inspector.md) `aws-inspector` — aws
- [AWS IoT Device Defender](https://localhost:3000/catalogue/components/aws-iot-device-defender.md) `aws-iot-device-defender` — aws
- [Amazon Macie](https://localhost:3000/catalogue/components/aws-macie.md) `aws-macie` — aws
- [Amazon Managed Grafana](https://localhost:3000/catalogue/components/aws-managed-grafana.md) `aws-managed-grafana` — aws
- [Amazon Managed Service for Prometheus](https://localhost:3000/catalogue/components/aws-managed-prometheus.md) `aws-managed-prometheus` — aws
- [AWS Migration Hub](https://localhost:3000/catalogue/components/aws-migration-hub.md) `aws-migration-hub` — aws
- [AWS Resilience Hub](https://localhost:3000/catalogue/components/aws-resilience-hub.md) `aws-resilience-hub` — aws
- [AWS Security Hub CSPM](https://localhost:3000/catalogue/components/aws-security-hub.md) `aws-security-hub` — aws
- [AWS Security Incident Response](https://localhost:3000/catalogue/components/aws-security-incident-response.md) `aws-security-incident-response` — aws
- [AWS Trusted Advisor](https://localhost:3000/catalogue/components/aws-trusted-advisor.md) `aws-trusted-advisor` — aws
- [AWS X-Ray](https://localhost:3000/catalogue/components/aws-xray.md) `aws-xray` — aws
- [Amazon CloudWatch](https://localhost:3000/catalogue/components/cloudwatch.md) `cloudwatch` — aws
- [Azure Advisor](https://localhost:3000/catalogue/components/azure-advisor.md) `azure-advisor` — azure
- [Application Insights](https://localhost:3000/catalogue/components/azure-application-insights.md) `azure-application-insights` — azure
- [Microsoft Defender External Attack Surface Management](https://localhost:3000/catalogue/components/azure-defender-easm.md) `azure-defender-easm` — azure
- [Microsoft Defender for Cloud](https://localhost:3000/catalogue/components/azure-defender-for-cloud.md) `azure-defender-for-cloud` — azure
- [Microsoft Defender for IoT](https://localhost:3000/catalogue/components/azure-defender-for-iot.md) `azure-defender-for-iot` — azure
- [Log Analytics workspace](https://localhost:3000/catalogue/components/azure-log-analytics.md) `azure-log-analytics` — azure
- and 134 more: https://localhost:3000/catalogue/kinds/monitoring.md

## Use it in a design

```yaml
nodes:
  - { id: "aws-cloudtrail-lake", component: "aws-cloudtrail-lake" }
```

## Source (`component` YAML, verbatim)

```yaml
# yaml-language-server: $schema=../../schema/component.schema.json
# AWS CloudTrail Lake event data store: an immutable, ORC-backed collection of audit events queried with SQL.
# In maintenance since 31 March 2026 and closed to new customers from 31 May 2026; existing users continue.
# "Working with AWS CloudTrail Lake" and "Managing CloudTrail Lake costs": One-year extendable retention pricing
# is the default option with a 366-day default retention (max 3653); all events are encrypted by CloudTrail.
schemaVersion: "1"
type: "component"
id: "aws-cloudtrail-lake"
kind: "monitoring"
provider: "aws"
docs: "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-manage-costs.html"
defaults:
  signal: "logs"
  collectorMode: "push"
  retentionDays: 366
  managed: true
properties:
  pricingOption:
    type: "enum"
    values: ["one-year-extendable-retention", "seven-year-retention"]
    default: "one-year-extendable-retention"
  eventCategory:
    type: "enum"
    values: ["cloudtrail-events", "insights-events", "config-items", "audit-manager-evidence", "external-events"]
    default: "cloudtrail-events"
  organizationScope:
    type: "boolean"
    default: false
  federationEnabled:
    type: "boolean"
    default: false
```

Human page: https://localhost:3000/catalogue/components/aws-cloudtrail-lake