Security & identity

Amazon Security Lake

Timenot billed
Bytesbilled
Unitsnot billed

In one line

Per GB of log data delivered into the lake, plus a separate per-GB charge to normalize it to OCSF.

What gets missed

CloudTrail events ingest at triple the rate of other sources, and normalization bills on top of ingestion. The S3 storage, Glue, EventBridge, Lambda and SQS under the lake are all billed separately.

Find it on your bill

Filter Cost Explorer or your Cost and Usage Report by these usage types. A usage type with no region prefix means us-east-1.

USE1-PaidCloudTrailEvents-Bytes
USE1-PaidOtherLogs-Bytes
USE1-PaidNormalization-Bytes

Bills the same way

These services turn exactly the same meters, so what you learn here transfers.