Opportunity Name

CloudTrail Optimize Retention

AWS Resource Type

AWS CloudTrail Lake event data stores

Opportunity Description

When you create a CloudTrail Lake event data store, AWS asks you to choose a pricing option. The seven-year retention pricing option charges a high per-GB fee at the moment events are ingested, and that single charge covers up to seven years of storage. You pay for all seven years of retention on day one, whether or not you ever query the data in years two through seven.

CloudFix scans your Cost and Usage Report for CloudTrail Lake ingestion charges, checks each event data store against the CloudTrail API to confirm which pricing option it is actually using, and produces a recommendation with a side-by-side cost comparison — upfront cost, spread-over-time cost, and NPV-adjusted cost — plus a cumulative-spend chart across your retention period.

Criteria for Identifying the Opportunity

The Finder is scoped to CloudTrail Lake ingestion usage types, sp classic CloudTrail trails delivering logs to S3 are never considered.

#	Validation	What it checks	Failure behavior
1	ResourceExists	GetEventDataStore returns the event data store and its Status is ENABLED	Rejected if the store is missing, in any non-enabled state, or the API call errors
2	SevenYearRetentionBilling	The store's BillingMode is not EXTENDABLE_RETENTION_PRICING	Rejected if already on one-year extendable pricing

A BillingMode that is absent or null is treated as FIXED_RETENTION_PRICING (seven-year retention pricing) and therefore passes validation 2 — an event data store that does not report an extendable billing mode is treated as a candidate.

Configurable parameters

Both values below are exposed and editable in the finder configuration:

Exclusions

• Any event data store tagged cloudfix:dontFixIt is excluded at the CUR stage.

• Event data stores already on one-year extendable retention pricing are excluded at validation 2.

• Event data stores not in the ENABLED state are excluded at validation 1.

• Classic CloudTrail trails writing to S3 are out of scope — this finder covers CloudTrail Lake event data stores only. CloudTrail Insights and CloudTrail-to-CloudWatch Logs delivery are likewise out of scope.

Potential Savings

Savings are driven entirely by how much data the event data store ingests, so the annualized CloudTrail Lake ingestion cost in your CUR is the input to the whole model.

CloudFix derives ingested volume from that cost and then models both pricing options using these assumptions, which are hardcoded in the finder and are not region-aware:

Worked example (default configuration: 7 years, 5% discount rate)

For an event data store with an annualized CloudTrail Lake ingestion cost of $1,825 (≈730 GB per year):

The recommended total breaks down as $547.50 of Year 1 ingestion plus $409.06 of discounted storage across Years 2 through 7.

That yields $124.06 in NPV-adjusted annual savings and $868.44 in NPV-adjusted lifetime savings over seven years — a 47.6% reduction.

What Happens When the Fixer Is Executed?

Note: This is a Finder-only opportunity. CloudFix does not perform any automated fix — there is no fixer runbook for this recommendation, and the opportunity is flagged as manual in the CloudFix catalogue.

CloudFix generates a recommendation containing:

• Account ID, region, and event data store name

• Current billing mode and annualized cost

• The full cost comparison table and cumulative-spend chart above

• Estimated annual and NPV-adjusted lifetime savings

• The target configuration: billing mode EXTENDABLE_RETENTION_PRICING, retaining the event data store's existing retention period (if the API does not report one, the recommendation assumes 2555 days / 7 years)

To apply the change yourself:

1. Confirm your compliance retention requirement for this event data store. The switch only makes sense if you are comfortable with the retention window you will end up on.

2. In the AWS Console, go to CloudTrail → Lake → Event data stores, select the store, and choose Edit.

3. Change the pricing option to One-year extendable retention pricing.

4. Explicitly set the retention period you want before saving. CloudFix's recommendation targets your current retention period, but the CloudFix UI carries a warning that switching pricing options can reset retention to the 90-day minimum, so verify the value on the edit screen rather than assuming it carries over.

5. Save, then re-check the store with aws cloudtrail get-event-data-store --event-data-store <arn> and confirm both BillingMode and RetentionPeriod.

The CLI equivalent of step 3 is:

aws cloudtrail update-event-data-store --event-data-store <arn> --billing-mode EXTENDABLE_RETENTION_PRICING --retention-period <days>. 

Valid retention periods run from 90 to 2555 days.

Important: reducing an event data store's retention period causes CloudTrail to remove events older than the new window. Review your audit and compliance obligations before shortening retention.

Is It Possible to Roll Back Once CloudFix Implements the Fixer?

Not applicable — this is a Finder-only recommendation, so CloudFix never changes your event data store and there is nothing for CloudFix to roll back.

If you make the change manually, be aware that AWS constrains when an event data store's pricing option can be changed, and that any events already aged out under a shortened retention period cannot be recovered. Treat the pricing-option change as effectively one-way and confirm the current rules in the AWS CloudTrail documentation before you proceed.

Can CloudFix Implement the Fix Automatically Once I Accept the Recommendation?

No. This opportunity is recommendation-only. CloudFix identifies the event data store, quantifies the saving, and reports it, but you must apply the pricing-option change yourself through the AWS Console, CLI, or your own infrastructure-as-code. Once you make the change, the event data store stops matching the SevenYearRetentionBilling validation and drops out of future scans.

Does This Fix Require Downtime?

No. Changing the pricing option on a CloudTrail Lake event data store is a configuration change — event ingestion and querying continue uninterrupted, and no application or workload is affected.

The risk here is data availability rather than downtime: if the retention period is reduced as part of the change, events older than the new retention window are removed and cannot be restored. Set retention explicitly to a value that satisfies your audit requirements before saving.

Additional Resources

• AWS CloudTrail Pricing

• Working with AWS CloudTrail Lake

• Managing CloudTrail Lake costs

• UpdateEventDataStore API reference

• AWS CLI: cloudtrail update-event-data-store