How much will my cloudtrail lake cost?

0

I have an existing org level CloudTrail but it is very slow when querying using Athena. I was thinking of using cloudtrail lake but I want to know how much would it cause me to use it? I don’t need all the events, just a few dates would do. Can you provide guidance please on how to estimate?

asked 9 months ago1215 views
3 Answers
1

CloudTrail Lake pricing is based on ‘ingest and store’, and analyze. You can use this link as reference for the CloudTrail Lake pricing. https://aws.amazon.com/cloudtrail/pricing/

You mentioned you already have an existing CloudTrail. If your intention is to have the same data in your CloudTrail Lake as what you have in your existing trail, you can check the s3 bucket where your events are stored to get the s3 bucket size or folder size (depending on what you want to ingest in your CloudTrail Lake).

Eg: If let’s say you only wish to ingest events from June 2023 for account 0123456789012 (a random sample account num):

You can go to the s3 bucket where the events are stored, and select the folder you would like to ingest. Eg: s3://bucketname/AWSLogs/o-orguniqueid/0123456789012/CloudTrail/us-west-1/2023

Select ‘06’ for June. Click Action > then click "Calculate total size". This will provide you the total size of that folder. Let’s say the size is 100 GB just for an example. You can refer to the pricing link to get the price and calculate for the expected cost link in the sample below.

based on the pricing page (https://aws.amazon.com/cloudtrail/pricing/), first 5TB is $2.5 per GB. Therefore: 100GB ingestion * $2.5 per BG = $250 of Ingestion cost.

You are also charged on per GB of data scan when you run queries. This depends on your query and your filter criteria. Eg: Let’s say you performed a select * query without a filter. This scans all 100GB data and will be charged as $0.005 per GB of data scanned, therefore $0.005 * 100GB = $0.5

You can can also see the S3 Storage Lens to find the bucket size.

NOTE!!!! Be cautions of using the S3 'Calculate total size' as it may incur some charges on the api request usage.

Hope this helps.

profile pictureAWS
EXPERT
answered 9 months ago
0

Hi, I would suggest to go to CloudTrail Lake pricing page: https://aws.amazon.com/cloudtrail/pricing/

as of this writing:

For CloudTrail Lake, you pay for ingestion and storage together, where the billing 
is based on the amount of uncompressed data ingested. You can store your data 
for up to seven years. The ingestion and storage price and tiering remain the same
 for the following features:

Ingestion of AWS sources including configuration items from AWS Config
Ingestion of non-AWS sources
Import from Amazon S3

For querying, choose which data to analyze, and pay as you proceed.

Feature	
Monthly pricing

Ingest and store

(price includes seven years of storage)

First 5 TB: $2.5 per GB

Next 20 TB: $1 per GB

Over 25 TB: $0.5 per GB

Analyze	
$0.005 per GB of data scanned

So, you'll have 2 cost dimensions:

  1. The volume of the CloudTrail logs that you ingest: this is clearly dependent on the activity happening in your account
  2. The volume of those logs that you analyze for your monitoring: each log can will be charged. So, you have to develop the optimal queries to minimize your costs.

The page above will show you some examples of such costs.

Best,

Didier

profile pictureAWS
EXPERT
answered 9 months ago
0

Hello Andres,

Great question. I don't think Cost calculator exist for CloudTrail Lake currently. To identify cost estimate, I will break this into 2 section:

  1. You will have to import/ingest data from CloudTrail into CloudTrail Lake. Importing event cost is same as Lake ingestion cost. Look into CloudTrail S3 folder to get an estimate of size of data you will be importing into lake.
  2. Cost of scanning data via query. This will depend on how many columns you have in select statement and if you are filtering (where clause) any data.

Hope this helps.

AWS
answered 9 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions