AWS CloudTrail pricing

Why AWS CloudTrail?

AWS CloudTrail enables auditing, security monitoring and operational troubleshooting by tracking your user activity and API calls.

Event history

Event history	CloudTrail logs management events across AWS services by default and is available for no charge. You can view, search, and download the most recent 90-day history of your account’s control plane activity at no additional cost using CloudTrail in the CloudTrail console. You can also use the CloudTrail lookup-events API to achieve this.
Trails	You can deliver one copy of your ongoing management events to your Amazon Simple Storage Service (S3) bucket for free by creating trails. Limits may apply.

Paid tier trails

Only pay for what you use. No minimum fee is required. You can deliver additional copies of events, including data and network activity events, by using trails. Amazon S3 charges apply and are not included in the listed pricing.

Note: If the management account has an organisation trail that delivers management events, the same events delivered with trails created in member accounts are charged as additional copies.

Paid tier trails

Feature	Pricing
Management events delivered to Amazon S3	€1.97372 per 100,000 management events delivered
Data events delivered to Amazon S3	€0.09869 per 100,000 data events delivered
Network activity events delivered to Amazon S3	€0.09869 per 100,000 network activity events delivered

Paid tier insights

CloudTrail Insights is charged based on the number of management events analysed per insights type. You can enable CloudTrail Insights events in your trails.

Paid tier insights

Feature	Pricing
CloudTrail Insights	€0.3454 per 100,000 events analysed per insight type

Pricing examples

Note: CloudTrail usage is calculated in binary gigabytes (GB), where 1 GB is 230 bytes. This unit of measurement is also known as a gibibyte (GiB), defined by the International Electrotechnical Commission (IEC). Similarly, 1 TB is 240 bytes or 1,024 GBs.

Example 1: Delivering management, data, and network activity events plus additional copies of management and data events through trails

You have the following usage in a given month:

5 million management events delivered
10 million data events delivered
5 million data events are copied across organisations and account-level trails
5 million network activity events delivered
2.5 million management events are copied across organisations and account-level trails

First copy of management events delivered at €0: 5,000,000 * €0 = €0
Data events at €0.09869 per 100,000 events = (10,000,000 + 5,000,000 additional copies of data events delivered) / 100,000 * €0.09869 = €14.8035
Network activity events at €0.09869 per 100,000 events = 5,000,000 / 100,000 * €0.09869 = €4.9345
Copies of management events delivered at €1.97372 per 100,000 events = 2,500,000 / 100,000 * €1.97372 = €49.343
CloudTrail charges for the month = €14.8035 + €4.9345 + €49.343 = €69.081

You will also incur charges for S3 storage and analysis, which are not yet included in this pricing calculation.

Example 2: identifying unusual activities with CloudTrail Insights

You have the following usage in a given month:
300,000,000 management events delivered to S3
20,000,000 write management events analysed by CloudTrail Insights

Cost of CloudTrail trails:
First copy of management events delivered at €0: 300,000,000 * €0 = €0
CloudTrail trails charges for the month = €0

Cost of CloudTrail Insights:
CloudTrail Insights events analysed at €0.3454 per 100,000 events = 20,000,000 / 100,000 * €0.3454 = €69.08
CloudTrail Insights charges = €69.08

Total CloudTrail charges for the month = €69.08