Audit log cost: the compliance requirement that quietly scales with your API traffic

Quick answer

Management event audit logs are cheap: AWS CloudTrail delivers one free copy per account, with additional trails at $2.00 per 100,000 events. Data events are the expensive part, at $0.10 per 100,000 events, because they fire on every S3 object and Lambda invocation. A bucket serving 500 million GET requests per month generates $500 in data event charges alone. CloudTrail Lake charges $2.50 per GB ingested with a one-year retention default. The rule: scope data events to sensitive prefixes and functions, never enable them account-wide.

Audit logging is the observability category you cannot optimize away, because the requirement comes from an auditor rather than an engineer. What you can control is scope, tier, and retention, and the difference between a thoughtful configuration and a checkbox enabled account-wide is often two orders of magnitude.

The two kinds of audit event

Event type	What it records	CloudTrail price
Management events	Control plane: create, delete, modify, IAM	First copy free per account, then $2.00 / 100k
Data events	Data plane: S3 object access, Lambda invokes, DynamoDB items	$0.10 / 100k events
Insights events	Anomalous API call rate detection	$0.35 / 100k events analyzed
CloudTrail Lake ingestion	Queryable audit store	$2.50 / GB ingested
CloudTrail Lake storage	After the retention period included	$0.023 / GB-month

Note the asymmetry. Management events are per-unit expensive but low volume: a busy account might generate 2 million management events a month, and the first copy is free. Data events are per-unit cheap but astronomically high volume, because they fire on individual object reads.

Why data events explode

A static asset bucket behind a CDN with a 90% cache hit rate still receives 50 million origin GET requests per month for a moderately busy site. With S3 data events enabled on that bucket, that is 50 million audit events at $0.10 per 100,000, or $50. Manageable. Now enable data events on all buckets in an account that includes a data lake serving 4 billion object reads per month for analytics jobs: 4 billion events at $0.10 per 100,000 is $4,000 per month, purely to record that a Spark job read a Parquet file.

Lambda is similar. Data events on Lambda invocations record every function call. A platform running 800 million invocations per month generates $800 in data events. DynamoDB item-level events on a high-traffic table can exceed both.

Scope	Monthly events	Data event cost
All S3 buckets, account-wide	4.2B	$4,200
Sensitive prefixes only (2% of traffic)	84M	$84
All Lambda functions	800M	$800
Functions touching regulated data only	30M	$30

Scoping is a 50x saving and it usually improves the audit trail rather than weakening it, because an audit log where 98% of entries are analytics jobs reading public assets is harder to review, not easier.

The delivery and storage layer

CloudTrail delivers to S3, where the audit logs then live under your own storage and lifecycle rules. A busy multi-account organization delivering to a central logging account might accumulate 200 GB per month of compressed CloudTrail JSON. In S3 Standard that is $4.60 per month, growing to $55 per month by year one. Object Lock in compliance mode, which many auditors expect for immutability, does not add a storage premium but it does mean you cannot delete objects early, so a seven-year retention decision is genuinely irreversible. Size it deliberately.

CloudTrail Lake is the queryable alternative at $2.50 per GB ingested. Ingesting the same 200 GB per month costs $500, which is a hundred times the S3 storage cost but buys SQL querying without building an Athena and Glue pipeline yourself. For organizations that query audit data monthly, building the Athena path is cheaper; for those doing continuous security analytics, the managed option often wins on total effort.

Other clouds, same shape

Azure Activity Log is free for 90 days of retention in its default store, with charges applying when you route it to a Log Analytics workspace at roughly $2.76 per GB for analytics logs, or about $0.15 per GB using the auxiliary tier. Routing every subscription's activity log to an analytics workspace is a common and expensive default.

Google Cloud Audit Logs split similarly: Admin Activity and System Event logs are free and cannot be disabled, while Data Access logs are charged at the standard Cloud Logging rate of $0.50 per GiB and are off by default for most services precisely because of their volume. Enabling Data Access logs broadly across a BigQuery-heavy organization is the Google equivalent of account-wide S3 data events.

A configuration that satisfies auditors and finance

Enable management events organization-wide, since the first copy is free and they are the events auditors actually ask about. Enable data events only on buckets, functions, and tables holding regulated or sensitive data, scoped by prefix where possible. Deliver to a central logging account with Object Lock for immutability. Set a lifecycle policy transitioning to Glacier Instant Retrieval after 180 days and Deep Archive after 400 days, sized to the actual retention obligation rather than a round number someone chose. Build an Athena table over the delivered logs for investigation.

Every piece of that is Terraform: the trail, its event selectors, the bucket, the Object Lock configuration, the lifecycle rules, and the Glue catalog. Price it from the plan against the resource catalog so the difference between account-wide data events and a scoped configuration shows up as a number in review, before it becomes a seven-year commitment you cannot unwind. The same discipline applies to security log retention generally.

FAQ

What makes audit logs expensive?

Data events, not management events. AWS CloudTrail delivers one free copy of management events per account, with additional trails at $2.00 per 100,000 events on a volume that is typically low. Data events cost $0.10 per 100,000 but fire on every S3 object read, Lambda invocation, and DynamoDB item access, so a data lake serving 4 billion object reads per month generates $4,000 in audit charges alone.

How do I reduce CloudTrail data event cost?

Scope them. Enabling data events account-wide on all S3 buckets in an environment generating 4.2 billion events per month costs $4,200. Restricting them to sensitive prefixes representing 2% of traffic brings that to $84, a 50x saving. The scoped trail is usually a better audit artifact too, since a log where 98% of entries are analytics jobs reading public assets is harder to review.

Is CloudTrail Lake worth it versus S3 plus Athena?

It depends on query frequency. CloudTrail Lake charges $2.50 per GB ingested, so 200 GB per month costs $500, roughly a hundred times the $4.60 it would cost in S3 Standard. Lake buys SQL querying without building a Glue and Athena pipeline. For organizations querying audit data monthly, the Athena path is far cheaper; for continuous security analytics, the managed option often wins on total effort.

How do Azure and Google Cloud audit logs bill?

Azure Activity Log is free for 90 days in its default store, with charges when routed to a Log Analytics workspace at roughly $2.76 per GB for analytics logs or about $0.15 per GB for the auxiliary tier. Google Cloud Admin Activity and System Event logs are free and cannot be disabled, while Data Access logs cost the standard $0.50 per GiB and are off by default for most services because of their volume.

What retention configuration should audit logs use?

Size it to the actual obligation, not a round number, because Object Lock in compliance mode makes it irreversible. A workable pattern is delivery to a central logging account with Object Lock, a lifecycle policy transitioning to Glacier Instant Retrieval at $0.004 per GB-month after 180 days and Deep Archive at $0.00099 after 400 days, with an Athena table over the delivered logs for investigation.

How does C3X help with audit log cost?

Trails, their event selectors, the destination bucket, Object Lock configuration, lifecycle rules, and the Glue catalog are all Terraform resources. C3X prices them from the plan, so the difference between account-wide data events and a scoped configuration appears as a number in the pull request, before it becomes a multi-year retention commitment that compliance rules prevent you from unwinding.

What to do next

Scope audit logging with the cost in front of you. C3X reads your Terraform and prices trails, buckets, and lifecycle rules against a live catalog. Start with the quickstart.