AWS CloudTrail records two types of events:

  • Management Events:  Represent standard API activity for AWS services. For example, CloudTrail delivers management events for API calls such as launching EC2 instances or creating S3 buckets. The first copy of management events is delivered free of charge. Additional copies of management events are charged at $2.00 per 100,000 events.
  • Data Events:  Represent S3 object-level API activity, such as Get, Put, Delete and List actions. Data events are recorded only for the buckets you specify and are charged at $0.10 per 100,000 events.

There is no charge from AWS CloudTrail for creating a trail. You can look up most management events for the last 7 days in each region without any charges. Learn more.

Example

Your AWS account is configured to deliver management events to two trails and data events to one trail. In a month, you had 150,000 management events and 2M data events. Your charges are calculated as follows:

Charges for the first copy of 150,000 management events = $0 (first copy of management events is free)
Charges for the second copy of 150,000 management events = 150,000 at a price of $2 per 100,000 events = $3
Charges for 2M data events = 2M at a price of $0.10 per 100,000 events = $2


Amazon S3 charges apply based on your usage, since AWS CloudTrail delivers logs to an S3 bucket. Typical Amazon S3 charges are less than $3 per month for most accounts.

You can optionally specify an Amazon SNS topic to get notified about CloudTrail log file delivery to Amazon S3, send CloudTrail logs to CloudWatch Logs, or encrypt your CloudTrail logs using AWS Key Management Service (AWS KMS). When these features are used, standard usage charges for the related services apply. For this pricing information, see the pricing page for each service.