AWS CloudTrail Pricing & Cost Guide

CloudTrail estimates are easiest when you split event volume by type and then apply your effective per-event pricing. The single most important split is management vs data events.

CloudTrail pricing inputs

Management events: baseline event volume.
Data events: S3/Lambda events per resource.
Insights: anomaly detection add-on if enabled.

What to model

Management events: control-plane actions (API calls that create/modify resources)
Data events: high-volume data-plane operations (can grow rapidly)
Insights events (if enabled): additional detections with their own pricing model
Downstream: storage + query + external ingest costs (S3/Athena/SIEM/CloudWatch)

Before pricing: define scope (this changes everything)

Accounts and regions: multi-account footprints multiply audit volume and downstream storage.
Data event resources: which buckets/prefixes/functions are in scope (avoid "all resources" defaults).
Retention expectations: how long you keep raw logs vs derived signals.

If you are doing a budget for the first time, start with a narrow scope and expand with measurement.

A fast estimation workflow

Estimate events/month for each bucket (management, data, insights).
Apply region pricing to each bucket (use official pricing for your region).
Add downstream costs: storage retention and query scans (often larger than expected).

Downstream costs (frequently larger than expected)

S3 storage: retained GB-month based on retention days and compression.
Query/scan: Athena or log platform scans (GB scanned per query * query frequency).
SIEM ingestion: forwarding everything into an expensive tool often dominates the total.
Copies and pipelines: replicated buckets, multiple destinations, and cross-account aggregation add storage and query duplication.

Retention cost Query scan cost

Common pitfalls

Enabling data events broadly without a volume estimate (volume can be orders of magnitude higher).
Forgetting automation and retries (deploys and incidents inflate event counts).
Ignoring downstream costs (S3 retention, Athena scans, SIEM ingestion).
Mixing environments/accounts in one estimate when governance differs.
Building dashboards that scan months of logs when a day-level query would answer the question.

Validation checklist

Measure event counts for at least 7 days and split by management vs data vs insight.
Confirm which resources and event types are included in your selectors.
Measure query scan sizes using your real investigations and dashboards.
Confirm retention and lifecycle policies (including any replicated copies).