How to Centralize AWS Security Logs With Amazon Security Lake

Retrospective: this article looks back at events from November 2022, written in 2026 with the benefit of hindsight.

Amazon Security Lake centralizes and normalizes security logs from AWS and other sources into OCSF format in your own S3 buckets. Here is how to set it up.

Step 1: Choose a delegated administrator

From your AWS Organizations management account, designate the security tooling or log archive account as the Security Lake delegated administrator.

Step 2: Enable Security Lake

In the delegated admin account:

Choose the regions to collect from and a rollup region to consolidate data.
Select AWS log sources: CloudTrail management events, CloudTrail data events (S3, Lambda — consider volume), VPC Flow Logs, Route 53 resolver query logs, Security Hub findings, EKS audit logs, AWS WAF logs.
Choose accounts (all organization accounts, with auto-enable for new accounts).
Set retention and storage class transitions (for example, move to cheaper storage after 30 days).

Step 3: Add third-party and custom sources

Security Lake supports custom sources that write OCSF-formatted data. Many security vendors provide integrations.

Step 4: Create subscribers

Query access for Amazon Athena or other tools reading directly from the lake.
Data access for SIEMs (including Microsoft Sentinel via its AWS connectors or partner integrations) that ingest from the lake.

Step 5: Control access

Restrict who can read the lake with Lake Formation permissions and S3 bucket policies. Log access.

Step 6: Watch costs

Security Lake pricing depends on data ingested and normalized, plus S3 storage. CloudTrail data events and flow logs can be large; enable selectively.

Verify

Query OCSF tables in Athena to confirm data from all accounts and regions arrives.