Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

CloudTrail Lake availability change

After careful consideration, we decided to close Amazon CloudTrail Lake to new customers starting May 31, 2026. If you would like to use CloudTrail Lake, sign up prior to that date. Existing customers can continue to use the service as normal.

Amazon CloudTrail Lake provides a managed solution for capturing, storing, and analyzing audit logs from Amazon and non-Amazon sources. Amazon CloudTrail continues to be available for existing customers, but CloudTrail Lake will only receive critical bug fixes and security updates.

This guide provides information about migration options for Amazon CloudTrail Lake customers.

Continued support for existing event data stores

Amazon CloudTrail Lake supports two types of event data stores (EDS): organization event data stores, and account event data stores. The level of continued support depends on which type you have configured.

Migration options

We recommend that you migrate your Amazon CloudTrail Lake logs data to Amazon CloudWatch.

Comparing architectures

The current Amazon CloudTrail Lake architecture provides a managed solution for capturing, storing, and analyzing audit logs through event data stores, and queries. This system operates as a feature within Amazon CloudTrail. The recommended alternative, Amazon CloudWatch, maintains the core ability to capture, store, and analyze CloudTrail logs. It unifies security, operations, and compliance data in one solution. Amazon CloudWatch offers additional capabilities such as native analytics powered by OpenSearch, pre-built connectors for popular third-party sources, open access through Apache Iceberg APIs, and built-in support for Open Cybersecurity Schema Framework (OCSF) and Open Telemetry (OTel) formats.

Migration procedure

Amazon recently introduced a simplified way to unify your operational and security data by allowing you to import historical CloudTrail Lake event data stores (EDS) directly into Amazon CloudWatch. This integration utilizes CloudWatch's new unified data management architecture to provide a single pane of glass for your logs.

Best Practice: The Pilot Approach

Before performing a full-scale migration of your historical data, it is highly recommended to perform a pilot migration using a small subset of data. This allows you to:

Once you are satisfied with the results, you can proceed with confidence to migrate the full historical dataset.

Once you've successfully migrated your historical dataset, you can enable live ingestion of CloudTrail logs from CloudWatch to ensure you continue to capture logs.

Prerequisites

Method 1: Using the CloudTrail Console (Recommended)

This is the most direct way to push data from your existing Lake Event Data Store.

Method 2: Using the Amazon CLI (create-import-task)

This method allows you to programmatically trigger the ingestion of historical event data.

Step 1: Identify the Source ARN

You will need the Amazon Resource Name (ARN) of your CloudTrail Lake Event Data Store. You can find this in the CloudTrail console or by running aws cloudtrail list-event-data-stores.

Step 2: Create the Import Task

Use the logs service to create the task. You must specify the destination log group, the source ARN, and the source type.

aws logs create-import-task \
    --import-source-arn "arn:aws:cloudtrail:region:account-id:eventdatastore/eds-id" \
    --import-role-arn "arn:aws:iam::account-id:role/role-name" \
    --import-filter '{"startEventTime": START_TIME, "endEventTime": END_TIME}'

Parameters:

Step 3: Monitor the Task Status

Because the import is asynchronous, you can check the progress of the migration using the describe-import-tasks command:

aws logs describe-import-tasks \
    --import-id "import-id"

Additional resources