CloudTrail data events cost: why S3 and Lambda logging gets expensive

Quick answer

CloudTrail management events (control-plane actions like creating a resource) are free for the first copy per account. Data events (data-plane actions like S3 object reads and writes or Lambda invocations) cost about $0.10 per 100,000 events. The catch is volume: a busy S3 bucket or a high-throughput Lambda can generate billions of data events a month. At $0.10 per 100,000, one billion events is about $1,000. So data events, not management events, are what make CloudTrail expensive. The fix: enable data events selectively with advanced event selectors, only on the resources that need audit logging, not blanket across every bucket and function.

CloudTrail records API activity for audit and security, and most teams think of it as nearly free, because management events, the control-plane actions like launching an instance or changing a policy, are free for the first copy. But CloudTrail also records data events, and those are charged per event. On high-throughput S3 buckets and Lambda functions, data events multiply into a bill that dwarfs everything else in CloudTrail.

Management events versus data events

Event type	What it records	Cost
Management events	Control-plane actions (create, modify, delete)	First copy free
Data events	Data-plane actions (S3 object access, Lambda invokes)	~$0.10 per 100,000
Insights events	Anomaly detection on activity	~$0.35 per 100,000

Management events capture who changed what in your account and are free for the first trail copy, which is why basic CloudTrail costs little. Data events capture individual data operations, every S3 GetObject and PutObject, every Lambda invocation, and cost about $0.10 per 100,000. Insights events, which detect unusual activity patterns, cost more per event.

Why data events explode

The volume difference between the two event types is enormous. An account might generate thousands of management events a day, costing nothing. But a busy S3 bucket serving millions of object reads, or a Lambda invoked millions of times, generates a data event for each operation. A bucket handling 500 million reads a month, with data events enabled, produces 500 million events at $0.10 per 100,000, about $500 a month for that one bucket. Enable data events on all buckets and functions blanket, and the total can reach thousands.

Selective data event logging

The key is that you do not need data events on everything. Advanced event selectors let you enable data events only on specific buckets, prefixes, or functions, and filter by event type, for example logging only write operations and not reads, or only a sensitive bucket rather than all of them. A security requirement usually applies to particular sensitive resources, not every object operation in the account. Scoping data events to exactly those resources captures the audit value while avoiding the billions of events from high-traffic, low-sensitivity buckets.

Keeping CloudTrail cost sensible

Keep the free management event trail for account-wide control-plane auditing. Enable data events only where a compliance or security need justifies them, scoped tightly with advanced event selectors. Avoid enabling data events on your highest-traffic buckets and functions unless you truly need per-object audit there. And remember that CloudTrail delivers to S3, so the destination storage adds a small cost too, covered alongsideCloudTrail optimization and the archival-focusedCloudTrail Lake pricing. Data events are one of thecharges that surprise teams who enable them broadly.

Because the cost is driven by which resources you log and their traffic, both decided up front, model it before enabling. Price your CloudTrail configuration against theresource catalog so the data event cost is understood before you turn it on across every bucket.

FAQ

How much do CloudTrail data events cost?

About $0.10 per 100,000 data events. Data events record data-plane operations like S3 object reads and writes and Lambda invocations, which occur at very high volume. One billion data events a month is about $1,000. Management events, which record control-plane actions, are free for the first trail copy, so data events are what make CloudTrail expensive.

Why is my CloudTrail bill high?

Almost certainly data events on high-traffic resources. Management events are free for the first copy, but data events cost about $0.10 per 100,000, and a busy S3 bucket or Lambda can generate hundreds of millions or billions of them. A bucket handling 500 million reads a month with data events enabled is about $500 for that one bucket. Blanket data event logging across all resources multiplies this.

What is the difference between management and data events?

Management events record control-plane actions like creating, modifying, or deleting resources, and are free for the first trail copy. Data events record data-plane operations like individual S3 object access and Lambda invocations, and cost about $0.10 per 100,000. Data events occur at vastly higher volume than management events, which is why they, not management events, drive CloudTrail cost.

How do I reduce CloudTrail data event cost?

Enable data events selectively using advanced event selectors: only on specific buckets, prefixes, or functions that need audit logging, and filter by operation type, for example logging only writes rather than reads. A security requirement usually applies to particular sensitive resources, not every object operation. Avoid blanket data event logging on high-traffic, low-sensitivity buckets and functions.

Do I need CloudTrail data events on every resource?

No. Management events give account-wide control-plane auditing for free, and data events are only needed where a compliance or security requirement demands per-object or per-invocation audit, which usually applies to specific sensitive resources. Enabling data events on your highest-traffic buckets and functions blanket generates billions of events and a large bill for audit data you rarely need on those resources.

How does C3X help with CloudTrail cost?

C3X prices your CloudTrail configuration from Terraform before you deploy, so the data event settings and their cost implications are visible in the pull request. That helps you see when data events are being enabled broadly across buckets and functions at design time, and scope them tightly with advanced event selectors, rather than discovering a large data event bill after high-traffic resources start logging every operation.

What to do next

Price your CloudTrail configuration before you enable data events. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.