Amazon Security Lake
Security log data lake
Automatically collects security logs from AWS (CloudTrail, VPC Flow, Route 53, Security Hub…) and external sources into your S3, normalized to the OCSF format for analysis with Athena or a SIEM.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?A little
- Serverless
Think of it asLike a security records archive where every document has been translated into the same language.
When to use it
✓ Use it when
You need centralized, long-term, normalized security log storage for a SIEM.
✗ Avoid it when
Just need to view aggregated alerts → Security Hub.
Common uses
- Collect logs from many accounts for a SIEM
- Query security logs with Athena
- Long-term log retention for investigations
What does it cost?
- Pricing model: Charged per GB of data ingested and normalized, plus the underlying S3, Glue, and Lambda fees.
