Import Historical data from AWS CloudTrail Lake to Amazon CloudWatch

This article explains how to migrate CloudTrail data from CloudTrail Lake to Amazon CloudWatch for unified security and operational monitoring.

• Export historical CloudTrail Lake data to CloudWatch for specific date ranges
• No additional ingestion cost when exporting from CloudTrail Lake to CloudWatch
• Create telemetry enablement rules to automatically ingest new CloudTrail events organization-wide
• Use cross-account cross-region centralization rules to consolidate logs into single destination
• CloudWatch provides unified querying across CloudTrail, VPC Flow Logs, WAF logs, and custom data
• Data prior to 2023 cannot be migrated; older events remain queryable in CloudTrail Lake
• Exported data uses Infrequent Access storage class requiring CloudWatch Logs Insights

This guide enables organizations to centralize CloudTrail activity across all AWS accounts and regions into CloudWatch for improved incident response, compliance reporting, and security analysis.