AWS CloudTrail Pricing: Complete Guide with Calculator

AWS CloudTrail pricing looks simple on the surface. Management events are free, right? In practice, CloudTrail has five or more billing dimensions, tiered Lake pricing, and hidden downstream costs that catch most teams off guard. I've seen teams report unexpected charges ranging from hundreds to thousands of dollars per month, all because they didn't fully understand how the pricing model works.

This guide breaks down every CloudTrail pricing component with exact dollar amounts. You'll get a Lake vs Trails cost comparison, real-world cost examples by company size, and 8 strategies to reduce your bill. If you want a quick personalized estimate, use the CloudTrail pricing calculator to model your specific event volumes and configuration. For broader cost planning, see our AWS cost estimation guide.

All pricing data in this article is sourced from the official AWS CloudTrail pricing page as of February 2026.

What Is AWS CloudTrail (and Why Pricing Matters)

AWS CloudTrail records user activity and API calls across your AWS environment. It answers a fundamental question for security and compliance: "Who did what, where, and when?" CloudTrail is a core pillar of AWS security best practices and account-level governance. Every IAM role change, every S3 bucket creation, every Lambda invocation can be tracked through CloudTrail.

Here's why pricing matters more than you might think: CloudTrail records four distinct event categories, and each one bills differently. Add three separate delivery mechanisms with their own cost models, and you've got a pricing matrix that's easy to misconfigure. Understanding this matrix before you set up trails and event data stores prevents the bill shock that sends people to re:Post forums asking "Why is my CloudTrail bill so high?"

Event Types That Drive Your Bill

Each event category has its own pricing rules:

• Management events (control plane): actions like creating S3 buckets, launching EC2 instances, or modifying IAM policies. The first copy per region is free. Additional copies cost $2.00 per 100,000 events.
• Data events (data plane): actions within resources like reading S3 objects, invoking Lambda functions, or DynamoDB item-level operations. Always charged at $0.10 per 100,000 events, including the first copy.
• Network activity events: actions made via VPC endpoints from a private VPC to AWS services. Always charged at $0.10 per 100,000 events. Supports S3, EC2, KMS, Secrets Manager, and CloudTrail.
• Insights events: anomaly detection events generated when CloudTrail identifies unusual API call rates or error rates. Charged per events analyzed, not per insight generated.

The critical distinction is that management events have a free tier, but data events, network activity events, and Insights always cost money from the first event. If you're also running Amazon GuardDuty (which analyzes CloudTrail events for threat detection), factor those costs into your security monitoring budget as well.

Delivery Mechanisms: Trails vs Lake vs Event History

CloudTrail offers three ways to store and access your events, each with different pricing implications:

• Event history: completely free 90-day searchable record of management events, available per region in the AWS console. No setup required.
• Trails: deliver events to S3 buckets (with optional CloudWatch Logs and EventBridge delivery). Per-event pricing applies, and S3 storage is billed separately.
• CloudTrail Lake: a managed data lake for ingesting, storing, and querying events with SQL. Pricing is based on ingestion volume, retention period, and query data scanned.

Before diving into paid pricing, let me clarify what CloudTrail gives you for free.

CloudTrail Free Tier: What You Actually Get for Free

One of the most common misconceptions about CloudTrail is "it's free." That's partially true, but the boundaries matter.

Here's exactly what you get at no charge:

Important clarifications that trip people up:

• The free trail only covers the first copy of management events. If you create a second trail in the same region, or an Organization trail delivers to a member account that already has its own trail, those additional copies cost $2.00 per 100,000 events.
• Data events always incur charges, even on your first trail. There is no free tier for S3 object-level logging or Lambda invocation tracking.
• Network activity events always incur charges. No free tier here either.
• S3 storage costs for trail log files are billed separately by Amazon S3.

Now that you know what's free, let's break down what you'll pay for.

Complete CloudTrail Pricing Breakdown (2026)

CloudTrail pricing spans multiple billing dimensions across trails, Insights, and CloudWatch delivery. The diagram below shows how all these components fit together, so you can see the full pricing landscape before diving into the details.

Trails Pricing (Management, Data, and Network Events)

Trails are the most common CloudTrail delivery mechanism. Here's the complete per-event pricing:

Network activity events became generally available in February 2025 and track API calls made through VPC endpoints. Most third-party pricing guides don't cover them yet, but they're an important dimension if you're monitoring private VPC traffic to AWS services.

Data Event Aggregation Pricing

Data event aggregation is a newer feature that consolidates high-volume data events into 5-minute summaries. Instead of processing millions of individual S3 or Lambda events, you get aggregated views.

This charge is in addition to standard data event charges ($0.10/100K). For a workload generating 300 million data events per month with 20 million analyzed for aggregation, the cost looks like this:

• 300M data events at $0.10/100K: $300
• 20M events analyzed for aggregation at $0.03/100K: $6
• Total: approximately $307/month

Aggregation makes sense when you have high-volume data events and want summarized views for security monitoring without processing every individual event.

Insights Pricing

CloudTrail Insights detects unusual patterns in your API activity. It analyzes events continuously and charges based on the volume of events analyzed, not the number of insights generated.

There are two insight types: ApiCallRateInsight (analyzes write management API call rates) and ApiErrorRateInsight (analyzes error rates). Each is charged independently, so enabling both doubles your Insights costs.

A worked example: with 300 million management events delivered (first copy free), 600 million data events ($600), 20 million management events analyzed by Insights ($70), and 50 million data events analyzed by Insights ($15), the total comes to $685/month.

Before enabling Insights, consider whether your event volumes justify the cost. For accounts with low API activity, the anomaly detection value may not outweigh the charges.

CloudWatch Logs Direct Delivery Pricing

CloudTrail can deliver events directly to CloudWatch Logs, but this comes with a combined charge that adds up fast:

At 1 TB of event delivery, you're looking at $768/month ($256 CloudTrail delivery + $512 CloudWatch ingestion). That's a significant cost for log analysis. If you need SQL-based event querying, CloudTrail Lake is often more cost-effective than the CloudWatch Logs path. You can estimate your CloudWatch costs separately to model this.

CloudTrail Lake has its own pricing model that deserves a dedicated breakdown.

CloudTrail Lake Pricing Deep Dive

CloudTrail Lake is AWS's managed data lake for event storage and analysis. Instead of delivering events to S3 and querying them with Athena, Lake handles ingestion, retention, and queries in a single service. The trade-off is a different (and more complex) pricing model.

Lake charges across three dimensions: ingestion, retention, and queries. Understanding how these interact is key to predicting your Lake costs accurately.

Ingestion Pricing Tiers

Lake offers two pricing options with very different cost profiles:

Ingestion is charged on uncompressed data. This is critical to understand when importing historical logs from S3, because gzip-compressed files expand significantly when decompressed for Lake ingestion.

At 1 TB/month, the difference is dramatic:

• One-year extendable: 1,024 GB x $0.75 = $768/month
• Seven-year retention: 1,024 GB x $2.50 = $2,560/month
• Savings with one-year extendable: 70%

Retention Pricing (One-Year vs Seven-Year)

The two pricing options handle retention very differently:

Retention charges are based on compressed data (Apache ORC format), not uncompressed. CloudTrail converts JSON events to ORC columnar format, which provides approximately 3:1 compression based on AWS pricing examples.

Query Pricing

Query costs depend on how much data you scan. For a practical example: 1 TB ingested, queried 5 times (2 ad-hoc queries + 3 dashboard queries), each scanning 1 TB of compressed data:

• Ingestion: 1,024 GB x $0.75 = $768.00
• 2 ad-hoc queries: 2 x 1,024 GB x $0.005 = $10.24
• 3 dashboard queries: 3 x 1,024 GB x $0.005 = $15.36
• Total: $793.60/month

The key to controlling query costs is constraining your eventTime range and specifying only the columns you need. I'll cover query optimization in the strategies section below.

Now that you understand both Trails and Lake pricing, let's compare them head to head.

CloudTrail Lake vs Trails: Which Costs Less?

This is the question I see most often in AWS forums, and no other guide provides a structured answer. The short version: it depends on your event volume, retention needs, and how frequently you query your logs. Let me walk through specific scenarios.

Use the CloudTrail pricing calculator to model your exact situation, but here's a framework to start with.

Cost Comparison by Scenario

The comparison isn't purely about price. Lake eliminates the operational overhead of managing S3 partitions, Glue crawlers, and Athena queries. Trails + S3 + Athena gives you more pricing flexibility but requires more operational investment.

Decision Framework

When to choose Trails: small to medium event volumes, short retention needs, or when you already have S3 and Athena workflows in place. Trails are also better when you need CloudTrail data in S3 for integration with third-party SIEM tools.

When to choose Lake: you need built-in SQL queries, multi-account event aggregation, compliance-driven retention requirements, or you want to avoid managing S3 partitioning and Athena infrastructure. For ingestion under 25 TB/month, always choose one-year extendable retention.

CloudTrail charges are only part of the story. Let's look at the costs most guides leave out.

Hidden Costs Most CloudTrail Guides Miss

This is where CloudTrail pricing gets truly complex, and where total cost of ownership matters most. The official AWS documentation on managing trail costs mentions these downstream charges, but most third-party guides skip them entirely. When I talk about total cost of ownership for CloudTrail, these are the costs that can equal or exceed your direct CloudTrail pricing charges.

S3 Storage Costs

Every trail delivers log files to S3 as gzip-compressed JSON. While compression helps, these files accumulate over time. Each log file delivery also generates S3 PUT requests, though at low volumes these costs are negligible. For a mid-size organization generating several GB of compressed logs per month, S3 Standard storage costs add up.

The fix is straightforward: apply S3 lifecycle policies to transition logs to Glacier after 90 days and delete them after your retention period. You can estimate the exact impact using the S3 pricing calculator.

CloudWatch Logs Ingestion Costs

If you're sending CloudTrail events to CloudWatch Logs, you pay $0.50/GB for CloudWatch ingestion on top of CloudTrail's $0.25/GB delivery charge. That's $0.75/GB total for CloudTrail events in CloudWatch.

At scale, this adds up fast. Before enabling CloudWatch delivery, ask yourself whether CloudTrail Lake or direct S3 + Athena analysis would serve the same purpose at lower cost. Use the CloudWatch pricing calculator to model your scenario.

KMS Encryption Overhead

Here's one that catches teams by surprise. If you're using SSE-KMS encryption on S3 buckets, every S3 operation generates KMS API calls. CloudTrail records these KMS calls as management events. On duplicate trails, this multiplies costs at $2.00 per 100,000 events.

The result: KMS encryption on busy S3 buckets can dramatically inflate your management event volume. You can estimate this impact with the KMS pricing calculator.

Athena Query Costs

If you're querying CloudTrail logs stored in S3 using Amazon Athena, you'll pay $5 per TB of data scanned. That's comparable to Lake's query pricing ($0.005/GB = $5.12/TB), but Athena charges are based on uncompressed data scanned while Lake charges on compressed data.

The key optimization for Athena: partition your logs by date and always use date filters in your queries to minimize scan volume. You can estimate query costs with the Athena pricing calculator.

If you've enabled SNS notifications on your trail, each log file delivery generates an SNS publish. For most setups these costs are minimal, but they're worth noting for complete cost visibility.

Let's put all these numbers together with real-world cost examples.

Real-World CloudTrail Cost Examples

Abstract per-unit rates are useful, but what does CloudTrail pricing actually look like for someone like you? Here are three scenarios based on common team sizes. For a personalized estimate, use the CloudTrail pricing calculator.

Solo Developer (1 Account, 1 Region)

If you're a solo developer or small team with a single account, CloudTrail is essentially free. The first copy of management events costs nothing, and S3 storage for a low-volume account is negligible. Unless you enable data event logging or create additional trails, CloudTrail won't make a dent in your bill.

Startup (5 Accounts, 2 Regions)

At the startup scale, your biggest cost driver is data events. If you're logging S3 object-level operations or Lambda invocations across multiple accounts, those charges add up at $0.10 per 100,000 events. The management event first copy remains free, assuming you use a single Organization trail without duplicate trails in member accounts.

If you add Insights for anomaly detection across 20 million management events, that adds approximately $70/month. Consider whether the security value justifies the cost at this scale.

Enterprise (50+ Accounts, Multi-Region)

Enterprise environments face the full spectrum of CloudTrail costs. Data events dominate at this scale, especially if you're logging S3 operations across dozens of accounts. The combination of trails, Lake, Insights, and downstream services can easily push costs above $2,000/month, and significantly higher for organizations with heavy data event volumes.

Now that you know what CloudTrail costs, let's look at how to reduce that number.

8 Strategies to Reduce CloudTrail Costs

Cost optimization for CloudTrail is about eliminating waste without sacrificing the audit visibility you need. These strategies are sourced from AWS documentation on managing trail costs and managing Lake costs, combined with patterns I've seen work in practice.

1. Eliminate Duplicate Trails

This is the single biggest savings opportunity for most organizations. The first copy of management events per region is free. Every additional copy costs $2.00 per 100,000 events.

The most common culprit: an Organization trail delivers management events to all member accounts, but individual member accounts also have their own trails. That's double billing for every management event.

How to audit: list all trails across your organization using the AWS CLI, then identify overlapping configurations. If an Organization trail covers the same events as individual account trails, remove the duplicates.

Expected savings: for a 50-account organization generating 5 million management events per month per account, eliminating duplicate trails saves $5,000/month.

2. Filter Noisy Event Sources

AWS KMS and Amazon RDS Data API generate extremely high volumes of management events. A single busy KMS key can produce millions of API calls per month.

CloudTrail provides checkboxes to exclude KMS and RDS Data API events when creating or updating a trail. With advanced event selectors, you can also filter on eventSource for more granular control.

Before filtering, verify that your security team doesn't need these events for compliance. In most cases, KMS event volumes far exceed what's useful for auditing.

3. Use Advanced Event Selectors

Advanced event selectors let you filter events by eventName, eventSource, eventType, readOnly, resources.type, resources.ARN, sessionCredentialFromConsole, and userIdentity.arn. This gives you surgical control over what gets logged and billed.

For example, you might log only write operations for S3 data events (skipping reads) or limit Lambda invocation tracking to production functions by ARN. Each filtered event is an event you don't pay for.

Note: CloudTrail allows up to 500 conditions across all advanced event selectors on a single trail or event data store, and you can have up to 5 trails per region.

4. Choose the Right Lake Pricing Option

If you're using CloudTrail Lake, pricing option selection has the biggest cost impact:

• Under 25 TB/month: choose one-year extendable retention. It's up to 70% cheaper than seven-year pricing at 1 TB/month.
• Over 25 TB/month with 7-year retention needs: seven-year pricing kicks in tiered discounts that make it more economical at scale (31% cheaper at 50 TB/month).

You can switch from seven-year to one-year extendable using the CloudTrail console, CLI, or UpdateEventDataStore API. Switching the other direction requires creating a new event data store.

5. Apply S3 Lifecycle Policies

Trail logs in S3 accumulate indefinitely unless you configure lifecycle policies. A practical approach:

• 0-90 days: S3 Standard (active analysis)
• 90-365 days: S3 Glacier Instant Retrieval (reduced cost, fast access if needed)
• After 365 days: Delete or move to S3 Glacier Deep Archive (if long-term compliance requires it)

This simple lifecycle policy can reduce your S3 storage costs for CloudTrail logs by 60-80% compared to keeping everything in S3 Standard.

6. Optimize Lake Queries

Lake query costs are $0.005/GB of compressed data scanned. Three quick wins:

• Always specify an eventTime range: without time constraints, queries scan the entire event data store
• Avoid SELECT *: specify only the columns you need to reduce data scanned
• Use UNION ALL instead of UNION and approx_distinct instead of COUNT(DISTINCT ...) for faster, cheaper queries

7. Monitor Costs with Cost Explorer

CloudTrail breaks down costs into specific usage types in Cost Explorer: PaidEventsRecorded, DataEventsRecorded, NetworkEventsRecorded, Ingestion-Bytes, and QueryScanned-Bytes. Filter by these to identify which cost dimension is growing fastest.

Lake event data stores support cost allocation tags, so you can track ingestion and query costs per team or project. This visibility is essential for chargeback and identifying optimization targets. For broader cost management, check out these AWS cost estimation tools.

8. Set Up AWS Budgets for CloudTrail

Create cost budgets with threshold alerts so you're notified before CloudTrail spending spikes. This is especially important for data events, where a new integration or increased traffic can cause sudden cost increases.

Note: trails do not currently support cost allocation tags, but Lake event data stores do. Use Lake tags for granular budget tracking. For a broader view of AWS cost optimization best practices, consider how CloudTrail fits into your overall FinOps strategy.

Before you optimize, make sure you're not making these common mistakes.

Common CloudTrail Cost Mistakes (and How to Fix Them)

I've seen these mistakes repeatedly. Each one has a specific dollar impact, so you can quickly assess whether you're affected.

1. Organization trail + member account trails = double billing. When an Organization trail replicates to every member account, individual trails in those accounts become paid duplicates at $2.00/100K events. Audit your multi-account setup and remove overlapping trails.

2. KMS encryption inflating management event volumes. SSE-KMS on S3 buckets causes every S3 operation to generate KMS API calls recorded as management events. On duplicate trails, this compounds costs dramatically. Consider SSE-S3 encryption for CloudTrail log buckets, or filter KMS events with advanced event selectors.

3. Data events on high-traffic S3 buckets. A single busy bucket generating 100 million data events per month costs $100 per trail. Multiply by duplicate trails and multiple buckets, and costs escalate fast. Use advanced event selectors to limit data event logging to the buckets that actually need audit coverage.

4. Lake ingestion on uncompressed data. CloudTrail Lake charges ingestion on uncompressed data. When importing historical logs from S3, gzip files are decompressed first. A 700 GB S3 archive can become 7 TB uncompressed, costing $3,500 at one-year extendable pricing ($0.50/GB for imports) or significantly more at seven-year pricing.

5. Lake queries without eventTime constraints. Running queries without time filters scans the entire event data store. At $0.005/GB scanned, querying a 10 TB compressed data store costs $50 per query. Always constrain your time range.

6. Misconfigured trails billing for 30 days. If a trail's S3 bucket is deleted or permissions are revoked, CloudTrail attempts redelivery for 30 days. These attempted deliveries still incur charges. Delete broken trails immediately to stop the billing.

Key Takeaways

CloudTrail pricing is manageable once you understand all the dimensions:

• Five or more billing dimensions cover trails, Lake, Insights, CloudWatch delivery, and downstream services. Understanding each prevents bill shock.
• The free tier covers event history and the first management event copy, but data events, network activity events, and additional copies always cost money.
• CloudTrail Lake one-year extendable retention is up to 70% cheaper than seven-year for workloads under 25 TB/month.
• Hidden downstream costs (S3 storage, CloudWatch ingestion, KMS encryption, Athena queries) can equal or exceed direct CloudTrail charges.
• Start optimization by auditing for duplicate trails. This is the single biggest savings opportunity for organizations using CloudTrail.

Use the CloudTrail pricing calculator to estimate your specific monthly cost based on your event volumes and configuration. Then work through the 8 optimization strategies above to bring that number down. Taking a shift-left approach to cloud costs means addressing CloudTrail configuration during code review, not after the bill arrives.

What's the biggest CloudTrail cost surprise you've encountered? Have you found optimization strategies beyond what's covered here? Share in the comments below.

Frequently Asked Questions