Most SCS-C02 candidates can describe the classic logging pipeline from memory: an organization trail writes to a central, locked-down S3 bucket, VPC Flow Logs and Route 53 Resolver logs land next to it, Athena queries the whole thing, and CloudWatch metric filters raise the alarms. That pipeline is still on the exam, and the logging and monitoring guide covers it. What the exam increasingly tests on top of it are the two managed data lakes AWS built so you do not have to assemble that pipeline yourself: Amazon Security Lake and AWS CloudTrail Lake.
They are easy to confuse because both have “Lake” in the name, both store years of security events, and both answer SQL queries. They solve different problems. Security Lake is a multi-source security data lake that normalizes everything to an open schema and hands the data to whatever tool you want. CloudTrail Lake is CloudTrail’s own queryable, immutable store for audit events and a few closely related record types. Exam questions hinge on the words that distinguish them: “normalize”, “third-party analytics tool”, “seven-year retention”, “no infrastructure to manage”, “multiple accounts and Regions in one query”. This guide gives you the mechanisms behind each of those words.
Scope note: the trail-to-S3-to-Athena design, CloudTrail integrity validation, Config, and CloudWatch Logs are taught in the logging and monitoring guide and are not re-taught here. Centralizing across an organization with delegated administrators is covered conceptually in the multi-account governance guide; here you get the Security Lake specifics.
Where This Sits on the SCS-C02 Exam
Both fall within the SCS-C02 exam guide’s in-scope services (CloudTrail Lake as a feature of AWS CloudTrail, Security Lake under Security, Identity, and Compliance). They appear mainly in Domain 2: Security Logging and Monitoring (18%), where task statements ask you to design and troubleshoot centralized logging, and to analyze logs with the right query tool. They also appear in Domain 1: Threat Detection and Incident Response (14%), where an investigator needs to search months of events across accounts quickly, and in Domain 6: Management and Security Governance (14%), where long-term audit retention is a compliance requirement.
The exam rarely asks “what is Security Lake?” It asks you to pick between four designs for a described requirement. The four candidates are nearly always the same:
- Trail to S3, queried with Athena (you build and maintain everything).
- CloudTrail Lake event data store (managed, CloudTrail-centric).
- Amazon Security Lake (managed, multi-source, OCSF, built for sharing with analytics tools).
- CloudWatch Logs with Logs Insights (near-real-time operational querying, short retention economics).
Learn what each one is uniquely good at and most questions become a vocabulary match.
Amazon Security Lake: The Mental Model
Security Lake is a Regional service that automatically collects security logs from supported AWS services, converts them into the Open Cybersecurity Schema Framework (OCSF) format, writes them as Apache Parquet into S3 buckets in your account, and manages access to that data for consumers. Three parts of that sentence carry the exam weight.
It collects the sources itself. You do not create VPC Flow Logs, enable Route 53 Resolver query logging or ship WAF logs for Security Lake. You tick the source in Security Lake, per account and per Region, and the service pulls the data directly from the producing service. That is the single biggest design difference from a hand-built pipeline, and it is why a “minimize operational overhead for collecting network, DNS and API logs across 200 accounts” question points at Security Lake.
It normalizes to OCSF. OCSF is an open, vendor-neutral schema (hosted by the Linux Foundation) that defines event classes such as API Activity, Network Activity, DNS Activity, HTTP Activity and Detection Finding, each with standard fields: time, class_uid, category_uid, activity_id, severity_id, actor, api, src_endpoint, dst_endpoint, cloud.account.uid, cloud.region and a catch-all unmapped map for anything the schema lacks. Normalization means one query shape works across CloudTrail, flow logs and a third-party firewall feed, and any OCSF-aware tool can consume the lake without a custom parser. When a question says “a common schema so the SOC can query all sources with one set of queries”, that is OCSF, and therefore Security Lake.
The data stays in your account. Security Lake creates one S3 bucket per enabled Region (named aws-security-data-lake-<region>-<suffix>), registers it with AWS Lake Formation, and builds AWS Glue Data Catalog tables over the Parquet objects. You own the buckets, you choose the encryption key, you set retention. Security Lake is the control plane; S3, Glue and Lake Formation are the data plane.
Natively supported sources
The exam expects you to know which AWS logs Security Lake can collect without any custom work, and the detail of how each is obtained.
| Source | How Security Lake collects it | OCSF event class |
|---|---|---|
| CloudTrail management events | Requires an existing multi-Region trail (an organization trail when you use Organizations) that logs read and write management events. Security Lake does not create the trail | API Activity |
| CloudTrail data events for S3 | Collected directly; you do not need data events enabled on a trail | API Activity |
| CloudTrail data events for Lambda | Collected directly, same as S3 | API Activity |
| VPC Flow Logs | Collected directly from the VPC service for every VPC in the Region, with the full field set. Independent of any flow logs you already publish | Network Activity |
| Route 53 Resolver query logs | Collected directly; you do not configure Resolver query logging | DNS Activity |
| Amazon EKS audit logs | Collected directly from the EKS control plane; you do not need control-plane logging to CloudWatch | API Activity |
| AWS WAF logs | Collected directly for web ACLs in the enabled Regions; no separate WAF logging destination required | HTTP Activity |
| AWS Security Hub findings | Delivered by Security Hub’s integration with Security Lake. Security Hub must be enabled and the integration accepted | Detection Finding |
Two traps live in this table. First, management events are the one source that depends on something you already have (a multi-Region trail), which is why “Security Lake is not receiving API calls” has the answer “no multi-Region organization trail exists”. Second, Security Lake’s collection of flow logs, Resolver logs and data events is independent of, and in addition to, any logging you already configured, so you may be paying twice if you leave the old destinations running. A cost-optimization question around that duplication is fair game.
Custom sources
Anything not in the table (a third-party firewall, an on-premises identity provider, your own application’s audit log) comes in as a custom source. You register the source with a name and an OCSF event class, and tell Security Lake which AWS account and external ID will write it. Security Lake creates an IAM role the producer assumes, an S3 prefix under ext/<source-name>/ in the lake bucket, and a Glue table (with a crawler) for the data. The producer’s job is to write Parquet files already in OCSF to that prefix using the partition layout Security Lake expects (region=, accountId=, eventDay=). Security Lake does not transform custom data; the producer must normalize it before writing. “Ingest a partner firewall’s logs so analysts query them with the same OCSF queries as VPC Flow Logs” is the custom-source signal.
Storage, encryption and lifecycle
- Format: Apache Parquet, partitioned by Region, account and event day, which keeps Athena scans small and cheap.
- Encryption: SSE-S3 by default. You can supply a customer-managed KMS key; the key policy must allow Security Lake and its metastore-manager role to use it, and any query-access subscriber in another account needs decrypt permission too.
- Retention: a per-Region lifecycle configuration with optional transitions (to cheaper S3 storage classes after N days) and an expiration (delete after N days). Nothing expires unless you say so.
- Access: governed by Lake Formation, not plain S3 bucket policies. A principal that can read the bucket but has no Lake Formation grant on the table cannot query it through Athena. This is deliberate: it lets you give a SOC team query access to one source’s table without exposing the whole bucket.
Rollup Regions
Security Lake is enabled per Region, and by default each Region’s data stays in that Region’s bucket. For a single pane of glass you designate a rollup Region and mark the others as contributing Regions. Security Lake then replicates the contributing Regions’ objects into the rollup Region’s bucket using S3 replication, so a single Athena query or a single subscriber sees every Region’s data. Points the exam probes:
- Security Lake must be enabled in the rollup Region too; it is a normal lake that also receives copies.
- Replication is a copy, not a move. The contributing Region still holds its data, so you typically give contributing Regions a short expiration and the rollup Region the long one.
- A subscriber configured in the rollup Region receives the data of every contributing Region. Configure subscribers once, centrally.
- Data residency: if a regulator forbids data leaving a Region, do not add that Region as a contributing Region.
Organizations and the delegated administrator
Security Lake integrates with AWS Organizations the way GuardDuty and Security Hub do. The management account registers a delegated administrator (any member account; AWS recommends not using the management account itself). From the delegated administrator you enable Security Lake across member accounts and Regions, pick sources per account, and turn on auto-enable so new accounts joining the organization are onboarded with a default source set. The delegated administrator sees and manages the whole lake; member accounts cannot opt out of what the administrator configured. The lake buckets live in the delegated administrator’s account.
Exam shorthand: “newly created accounts must automatically start sending CloudTrail, flow logs and DNS logs to the central security team with no per-account setup” is delegated administrator plus auto-enable in Security Lake.
Subscribers: How Data Leaves the Lake
Collection is half of Security Lake; the other half is subscribers, the consumers you grant access to. There are two kinds, and distinguishing them is a reliable question.
Data access subscribers
A data access subscriber reads the Parquet objects directly from S3. You register the subscriber by AWS account ID and an external ID, choose which sources (and, in a rollup Region, which Regions) it may read, and Security Lake creates an IAM role in your account that the subscriber assumes. Security Lake also sets up notifications so the subscriber knows when new objects land, either an SQS queue that Security Lake creates and populates, or an HTTPS endpoint that Security Lake calls through an EventBridge API destination. Most SIEM-style integrations are data access subscribers: they poll the queue, fetch the new objects, and index them in their own storage.
Use data access when the consumer wants the raw normalized files and will store or process them elsewhere.
Query access subscribers
A query access subscriber queries the data in place using Athena (or another Lake Formation-aware engine) without copying it. Security Lake grants the subscriber’s account Lake Formation permissions on the Glue tables for the selected sources. In the subscriber account, an administrator creates resource links in their own Glue Data Catalog pointing at the shared tables, and analysts query them with Athena. The data never leaves your bucket; the subscriber pays the Athena scan costs.
Use query access when the consumer is an analyst team, a data-science notebook or a dashboard that just needs SQL over the lake.
| Data access subscriber | Query access subscriber | |
|---|---|---|
| Access mechanism | Assumes an IAM role, reads S3 objects | Lake Formation grants on Glue tables |
| Notification | SQS queue or HTTPS endpoint (EventBridge) | None; queries run on demand |
| Data movement | Subscriber copies objects out | In-place queries, no copy |
| Typical consumer | SIEM, SOAR, long-term archive tooling | Athena users, BI, notebooks |
| Cost model | S3 request and transfer costs | Athena per-TB-scanned in the subscriber account |
A third consumption path worth one line: Amazon OpenSearch Service can query Security Lake directly (zero-ETL direct query) so analysts get OpenSearch dashboards over the lake without ingesting into an OpenSearch domain. If a question insists on OpenSearch visualizations with no duplication of data, that is the feature.
Querying with Athena yourself
The lake owner queries through the Glue database Security Lake created. Table names encode the Region, the source and the source version; current tables carry a 2_0 suffix and use OCSF 1.1. A typical hunt for someone tampering with CloudTrail looks like this:
SELECT time_dt,
api.operation,
actor.user.uid,
src_endpoint.ip,
cloud.account.uid,
cloud.region
FROM "amazon_security_lake_glue_db_us_east_1"."amazon_security_lake_table_us_east_1_cloud_trail_mgmt_2_0"
WHERE eventday BETWEEN '20261010' AND '20261017'
AND api.operation IN ('StopLogging', 'DeleteTrail', 'PutEventSelectors')
ORDER BY time_dt DESC;Note the partition filter on eventday: without it Athena scans every day of every account, and the exam does like a “queries are slow and expensive” question whose fix is “filter on the partition columns”.
What Security Lake costs you
Security Lake’s own charge is per GB ingested and normalized for the natively supported sources (CloudTrail is priced differently from the other sources). Custom sources are not metered by Security Lake for ingestion because you do the normalization. On top of that you pay the usual S3 storage, S3 replication for rollup Regions, Glue, and whatever query engine you use. When a question wants to cut Security Lake cost, the real levers are: do not enable sources you do not use (S3 data events are the classic volume driver), expire contributing-Region copies quickly, and partition-filter your queries.
AWS CloudTrail Lake: The Mental Model
CloudTrail Lake is a managed, immutable, SQL-queryable store for CloudTrail events and a small set of related record types, with retention measured in years and no infrastructure to run. Where Security Lake is about many sources and open sharing, CloudTrail Lake is about audit events, deep retention and running SQL in the CloudTrail console or API with zero setup.
Event data stores
The unit of CloudTrail Lake is the event data store (EDS). You create one, choose what it ingests, and queries run against it (you can also join across several). Facts the exam leans on:
- An EDS can be single-account or organization-wide, and single-Region or multi-Region. An organization, multi-Region EDS gives you one place to query every account and Region, which is the “single query across the organization” selling point.
- Events are immutable. Nobody, including an administrator, can edit or delete individual events. That is the compliance argument that a trail-to-S3 design can only approximate with Object Lock.
- Termination protection is on by default so an EDS cannot be deleted by accident; disabling it is itself a logged API call. Deletion then enters a seven-day pending window.
- Encryption uses an AWS-owned key by default, or a customer-managed KMS key you specify.
- You can stop and restart ingestion without losing stored events.
- Advanced event selectors filter what the EDS ingests (by event category, read-only flag, event name, event source, resource type), which is how you keep the store small and the ingestion bill down.
What an EDS can ingest
This list is a frequent trap because people assume CloudTrail Lake is CloudTrail only.
| Record type | Notes |
|---|---|
| CloudTrail management events | Read and write, filterable |
| CloudTrail data events | S3 objects, Lambda, DynamoDB and the other data-event resource types |
| CloudTrail network activity events | API calls that travel through VPC endpoints for supported services (EC2, KMS, Secrets Manager, CloudTrail and others), including calls the endpoint policy denied. The data-perimeter use case: “show every attempt to reach KMS over the endpoint from an identity outside our organization” |
| CloudTrail Insights events | Unusual API call rates and error rates; can go to their own EDS |
| AWS Config configuration items | Every configuration change Config records, queryable with SQL alongside the API calls that caused them |
| AWS Audit Manager evidence | Evidence collected for Audit Manager assessments |
| Events from outside AWS | Via integrations: a channel plus the PutAuditEvents API lets your own applications or partner tools write custom audit events |
| Imported trail logs | Copy existing trail log files from S3 into an EDS so historical events become queryable alongside new ones |
The S3 import is the bridge for organizations that ran trails for years and want everything in Lake: import the old files, point the EDS at live events, query seven years in one place.
Retention pricing tiers
The exam tests the two pricing options because they drive the “seven years” questions.
| Option | Default retention | Maximum retention | When it fits |
|---|---|---|---|
| One-year extendable retention pricing | 366 days | 3,653 days (10 years); you pay a lower ingestion rate and then a storage charge for data kept beyond the first year | Flexible needs, retention that may change, most teams |
| Seven-year retention pricing | 2,557 days | 2,557 days (7 years); a higher ingestion rate that includes seven years of storage | Fixed regulatory retention, predictable cost |
Queries are billed per GB of data scanned, and like Athena the fix for an expensive query is a tighter WHERE on eventTime and specific fields.
Querying
CloudTrail Lake uses a SQL subset (SELECT statements only) directly in the console or via StartQuery. The table name is the EDS ID. A classic incident-response query:
SELECT eventTime, eventName, eventSource,
userIdentity.arn, sourceIPAddress, errorCode
FROM 2b3c4d5e-6f70-4a8b-9c0d-1e2f3a4b5c6d
WHERE eventTime > '2026-10-01 00:00:00'
AND userIdentity.arn LIKE '%AssumedRole/ContractorRole%'
AND eventName IN ('CreateUser', 'AttachUserPolicy', 'CreateAccessKey')
ORDER BY eventTime DESC
LIMIT 100;Query results can be saved to an S3 bucket for hand-off to other tooling. Two newer capabilities sit on top of queries and show up in “least effort” wording: Lake dashboards (a managed Highlights dashboard refreshed on a schedule, plus custom dashboards built from saved queries) and natural-language query generation, where you describe the question in plain English and CloudTrail Lake produces the SQL.
Lake Formation federation
Querying inside the CloudTrail console is convenient but isolated. Federation registers the EDS with Lake Formation and the Glue Data Catalog so Athena, and any other Lake Formation-aware engine, can query CloudTrail Lake data and join it with other tables: Security Lake tables, your application logs, an asset inventory. You enable it per EDS with a federation role:
aws cloudtrail enable-federation \
--event-data-store arn:aws:cloudtrail:us-east-1:111122223333:eventdatastore/2b3c4d5e-6f70-4a8b-9c0d-1e2f3a4b5c6d \
--federation-role-arn arn:aws:iam::111122223333:role/CloudTrailLakeFederationRoleFederation is the answer when a question wants CloudTrail Lake’s managed retention and Athena-style joins with other data.
Security Lake vs CloudTrail Lake vs Trail + Athena vs CloudWatch Logs
| Requirement in the question | Best fit | Why |
|---|---|---|
| Collect API, network, DNS, EKS, WAF and findings across many accounts with minimal setup | Security Lake | Pulls the sources itself; delegated admin and auto-enable |
| Normalize to a common schema for the SOC’s analytics tool | Security Lake | OCSF is its whole purpose |
| Share security data with a third-party tool or another account without copying buckets around | Security Lake | Data access or query access subscribers |
| Keep data in your own S3 with your own KMS key and lifecycle | Security Lake (also trail + S3) | You own the buckets |
| SQL over seven to ten years of audit events with no infrastructure | CloudTrail Lake | Managed EDS, retention tiers, immutability |
| Query Config configuration items and the API calls that changed them together | CloudTrail Lake | Config items are an EDS source |
| See API calls denied by a VPC endpoint policy | CloudTrail Lake | Network activity events |
| Record custom audit events from your own application alongside CloudTrail | CloudTrail Lake | Integrations and PutAuditEvents |
| Make historical trail files queryable without re-collecting | CloudTrail Lake | S3 import |
| Full control of format, partitioning and cost for logs already in S3 | Trail + Athena | You already have the data; partition projection keeps it cheap |
| Alert within minutes on a specific API call | CloudWatch Logs metric filter and alarm | Lakes are for investigation, not real-time alerting |
| Interactive, ad-hoc troubleshooting of recent application logs | CloudWatch Logs Insights | Short-retention operational querying |
The one-sentence version: Security Lake is a normalized, multi-source lake you share; CloudTrail Lake is a deep-retention audit store you query. Both can coexist, and federation plus Security Lake’s Athena tables is how you join them.
Worked Exam Scenarios
Scenario 1. A security team with 150 accounts wants VPC Flow Logs, Route 53 Resolver logs and CloudTrail management events from every account in a central location, queryable by Athena and consumable by their SIEM, with new accounts onboarded automatically and no per-account scripts. Answer: Security Lake with a delegated administrator, auto-enable for new accounts, the three sources selected, a rollup Region, and the SIEM registered as a data access subscriber with SQS notifications. Trail + Athena is wrong because it leaves you building flow-log and Resolver-log collection in every account.
Scenario 2. Security Lake is enabled but the CloudTrail management events table is empty, while VPC Flow Logs are arriving. Answer: management events require an existing multi-Region organization trail logging read and write management events. Create (or fix) the trail; Security Lake collects the other sources directly, which is why they work.
Scenario 3. A partner firewall appliance must deliver logs into the lake so analysts use the same OCSF queries they use for VPC Flow Logs. Answer: create a custom source with the Network Activity event class, give the appliance’s account the generated role, and have it write OCSF-formatted Parquet to the ext/ prefix. Security Lake will not convert the partner’s native format for you.
Scenario 4. An analytics team in a separate account needs to run Athena queries over Security Hub findings in the lake but must not be able to download the raw objects. Answer: a query access subscriber scoped to the Security Hub source. Lake Formation grants table access; no S3 role is issued. A data access subscriber would hand them the objects.
Scenario 5. A regulated company must retain every management and data event for seven years, guarantee events cannot be altered, and let auditors run SQL without the security team building anything. Answer: an organization-wide, multi-Region CloudTrail Lake event data store with seven-year retention pricing and termination protection. Immutability plus managed retention beats trail + S3 + Object Lock on “no infrastructure”.
Scenario 6. Investigators need to prove whether anyone outside the organization attempted to call KMS through the company’s interface endpoints, including attempts the endpoint policy blocked. Answer: CloudTrail Lake network activity events for the KMS endpoint. Regular management events do not show calls that the endpoint policy denied before they reached the service.
Scenario 7. The company has three years of trail logs in S3 and wants them queryable in CloudTrail Lake together with live events, then wants to join those results with an asset table in Athena. Answer: import the S3 trail files into an EDS, enable federation so the EDS appears in the Glue Data Catalog, and query from Athena.
Scenario 8. Athena queries against Security Lake are slow and cost far more than expected. Answer: the queries lack partition filters. Add eventday (and region or accountid where possible) to the WHERE clause; the Parquet layout is partitioned exactly for that.
Common Traps
- Assuming Security Lake needs you to configure flow logs or Resolver logging. It does not; it collects those directly. Only CloudTrail management events depend on an existing trail.
- Forgetting the double-logging cost. Security Lake’s direct collection is additive. Turn off redundant flow-log and Resolver-log destinations once the lake owns them.
- Granting S3 bucket policy access and expecting Athena to work. Security Lake access is through Lake Formation. Fix the Lake Formation grant, not the bucket policy.
- Mixing up subscriber types. Role plus S3 plus SQS is data access. Lake Formation plus resource links plus Athena is query access.
- Treating CloudTrail Lake as CloudTrail only. Config items, Audit Manager evidence, network activity events and custom events via
PutAuditEventsare all valid EDS content. - Picking seven-year pricing for flexibility. Seven-year pricing caps at seven years. One-year extendable goes to ten.
- Using either lake for real-time alerting. Both are investigation and compliance tools. Alerts come from CloudWatch metric filters, EventBridge rules, GuardDuty and Security Hub.
- Adding a data-residency-restricted Region as a contributing Region. Rollup replication moves copies across Regions.
Practice the Decision Under Exam Pressure
These questions are never labelled “Security Lake” or “CloudTrail Lake”. They arrive as a paragraph about an auditor, a SIEM vendor, a seven-year retention mandate or a slow investigation, with four plausible architectures underneath. Getting fast at spotting the discriminating word takes repetition against realistic wording. Sailor.sh’s AWS Certified Security - Specialty (SCS-C02) Mock Exam Bundle includes eight full-length mock exams whose logging, detection and governance scenarios are written in that indirect style, with explanations that walk through why one lake, a trail with Athena, or CloudWatch Logs is the best answer for the stated requirement. Pair it with the SCS-C02 practice questions, the 30-day study plan and the threat detection and incident response guide to cover the domains these services touch.
Frequently Asked Questions
What is the difference between Amazon Security Lake and CloudTrail Lake?
Security Lake is a multi-source security data lake: it collects CloudTrail, VPC Flow Logs, Route 53 Resolver logs, EKS audit logs, WAF logs, Security Hub findings and custom sources, normalizes them to OCSF Parquet in S3 buckets you own, and shares them with subscribers. CloudTrail Lake is CloudTrail’s managed, immutable event data store for audit events (plus Config items, Audit Manager evidence, network activity events and custom audit events) with SQL querying and retention up to ten years. Use Security Lake to normalize and share; use CloudTrail Lake for deep-retention audit querying with no infrastructure.
Does Amazon Security Lake require me to enable VPC Flow Logs first?
No. Security Lake collects VPC Flow Logs, Route 53 Resolver query logs, EKS audit logs, WAF logs and CloudTrail data events directly from the producing services. The exception is CloudTrail management events, which need an existing multi-Region (organization) trail that logs read and write management events.
What is OCSF and why does Security Lake use it?
The Open Cybersecurity Schema Framework is an open, vendor-neutral schema for security events with standard classes such as API Activity, Network Activity, DNS Activity and Detection Finding. Security Lake converts every source into OCSF so one set of queries and one set of tools work across all of them, and so any OCSF-aware product can consume the lake without a custom parser.
What is the difference between a data access subscriber and a query access subscriber?
A data access subscriber assumes an IAM role and reads the Parquet objects from S3, with new-object notifications through an SQS queue or an HTTPS endpoint; it is how SIEMs ingest the lake. A query access subscriber receives Lake Formation permissions on the Glue tables and queries the data in place with Athena through resource links; no objects are copied out.
What is a Security Lake rollup Region?
A Region you designate to receive replicated copies of the data from contributing Regions, so one query or one subscriber covers every Region. Security Lake must be enabled in the rollup Region, replication is a copy rather than a move, and you should keep data-residency-restricted Regions out of the contributing set.
How long can CloudTrail Lake retain events?
Up to 3,653 days (10 years) with one-year extendable retention pricing, or up to 2,557 days (7 years) with seven-year retention pricing. The seven-year option bundles storage into a higher ingestion rate; the one-year option charges less for ingestion and then bills for data retained beyond the first year.
Can CloudTrail Lake store anything other than CloudTrail events?
Yes. An event data store can ingest AWS Config configuration items, AWS Audit Manager evidence, CloudTrail Insights events, CloudTrail network activity events from VPC endpoints, events from your own applications or partner tools through integrations and the PutAuditEvents API, and historical trail log files imported from S3.
When should I use Athena on a trail bucket instead of CloudTrail Lake?
When the logs are already in S3, you want to control format and partitioning, or you need to query them alongside other S3 datasets with full cost control. CloudTrail Lake wins when you want immutability, managed multi-year retention, organization-wide multi-Region querying and no infrastructure. Federation lets you have both: CloudTrail Lake retention with Athena joins.
Key Takeaways
- Security Lake collects supported sources itself, normalizes to OCSF Parquet in your S3 buckets, and governs access through Lake Formation.
- Only CloudTrail management events depend on an existing multi-Region trail; every other native source is pulled directly.
- Data access subscribers read S3 through a role with SQS or HTTPS notifications; query access subscribers get Lake Formation grants and query in place.
- Rollup Regions replicate copies for a single view; keep residency-restricted Regions out.
- Delegated administrator plus auto-enable is the organization-wide onboarding answer.
- CloudTrail Lake’s event data store is immutable, organization- and multi-Region-capable, and ingests Config items, Audit Manager evidence, network activity events, custom events and imported trail files.
- Retention: 10 years on one-year extendable pricing, 7 years on seven-year pricing; queries bill per GB scanned.
- Federation exposes an EDS to Athena and Lake Formation for joins with other data.
- Neither lake is an alerting tool; alerts still come from CloudWatch, EventBridge, GuardDuty and Security Hub.