AWS CloudTrail enables auditing, security monitoring, and operational troubleshooting by tracking your user activity and API calls.

AWS Free Tier

To learn more about event history, CloudTrail Lake, and trails, see CloudTrail features.

Event history

AWS CloudTrail logs management events across AWS services by default and is available for at no charge. You can view, search, and download the most recent 90-day history of your account’s control plane activity at no additional cost using CloudTrail in the CloudTrail console or by using the CloudTrail lookup-events API.

Lake

New customers can try CloudTrail Lake for 30 days at no additional cost. You will have access to the full feature set during this time. During the 30-day free trial period, you’ll have the following limits:

  • Ingest up to 5 GB of data
  • Scan up to 5 GB of data
  • Store data at no additional cost

Your free trial expires after 30 days or when you reach the free usage limits, whichever comes first. When your free trial expires, you can continue using AWS CloudTrail Lake without interruption at the standard, pay-as-you-go service rates described in the Paid Tier section.

Trails You can deliver one copy of your ongoing management events to your Amazon S3 bucket for free by creating trails. Limits may apply.
  • Lake
  • For AWS CloudTrail Lake, you pay for ingestion and storage together. You can store your data for up to seven years. The ingestion and storage price and tiering remain the same for the following features:

    • Ingestion of AWS sources
    • Import of existing CloudTrail logs from Amazon S3

    For querying, choose which data to analyze, and pay as you go.

    Feature

    Monthly pricing

    Ingest and store

    (price includes seven years of storage)

    First 5 TB: $2.5 per GB

    Next 20 TB: $1 per GB

    Over 25 TB: $0.5 per GB

    Analyze

    $0.005 per GB of data scanned

  • Trails
  • Pay for only what you use. No minimum fee is required. You can deliver additional copies of events, including data events, by using trails. Amazon S3 charges apply and are not included in the listed pricing.

    Note: If the management account has an organization trail that delivers management events, the same events delivered with trails created in member accounts are charged as additional copies.

    Feature

    Pricing

    Management events delivered to Amazon S3 $2.00 per 100,000 management events delivered (after first free copy; see AWS Free Tier for details)
    Data events delivered to Amazon S3

    $0.10 per 100,000 data events delivered

    CloudTrail Insights $0.35 per 100,000 events analyzed
  • Insights
  • For CloudTrail Insights, choose which event to analyze and pay as you go. You can enable CloudTrail Insights events in your trails.

    Feature

    Pricing

    CloudTrail Insights $0.35 per 100,000 events analyzed

Pricing examples

Note: AWS CloudTrail usage is calculated in binary gigabytes (GB), where 1 GB is 230 bytes. This unit of measurement is also known as a gibibyte (GiB), defined by the International Electrotechnical Commission (IEC). Similarly, 1 TB is 240 bytes, i.e. 1024 GBs.

Example 1: Recording and analyzing events using CloudTrail Lake

Assume that you have 10 GB of events ingested to CloudTrail Lake in a given month in your account. Also assume that you designed your queries to scan this data twice in that month.

Monthly ingestion and storage charges: 10 GB * $2.5 per GB = $25
Monthly data scanned: 10 GB scanned two times * 0.005 per GB = $0.1
               First scan: 10 GB * 0.005 = $0.05
               Second scan: 10 GB * 0.005 = $0.05
               Total scans: $0.05 + $0.050 = $0.10

Monthly CloudTrail Lake charges: $25 +  $0.1 = $25.1

Example 2: Recording and analyzing events using CloudTrail Lake

Assume that you have 50 TB of events ingested to CloudTrail Lake in a given month in your account. Also assume that you designed your queries to scan this data twice in that month.

Monthly ingestion and storage charges = $46,080

First 5 TB at $2.5 per GB = $12,800
Next 20 TB at $1 per GB = $20,480
Next 25 TB at $0.5 per GB = $12,800

Monthly Data Scanned
50 TB scanned two times at $0.005 per GB = $512

Monthly CloudTrail Lake charges = $46,080 + $512 = $46,592

Example 3: Delivering management events through trails

Assume that you have 3 billion management events delivered to Amazon S3 in a given month.

First copy of management events delivered at $0: 3,000,000,000 * $0 = $0
Monthly CloudTrail charges = $0

Amazon S3 storage and analysis is not included in this pricing.

Example 4: Delivering management and data events plus additional copies through trails

Assume that you have the following usage in a given month:

5 billion management events delivered
10 billion data events delivered
2.5 billion management events are copied across organization and account-level trails
5 billion data events are copied across organization and account-level trails

First copy of management events delivered at $0: 3,000,000,000 * $0 = $0
Data events at $0.10 per 100,000 events = (10,000,000,000 + 5,000,000,000 additional copies of data events delivered) / 100,000 * $0.10 = $15,000
Copies of management events delivered at $2.00 per 100,000 events = 2,500,000,000 / 100,000 * $2.00 = $50,000
Monthly CloudTrail charges = $15,000 + $50,000 = $65,000

Amazon S3 storage and analysis is not included in this pricing.

Example 5: Identifying unusual activities with CloudTrail Insights

Assume that you have the following usage in a given month:

300,000,000 management events delivered to Amazon S3
20,000,000 write management events analyzed by CloudTrail Insights

Cost of CloudTrail trails:
First copy of management events delivered at $0: 300,000,000 * $0 = $0
Monthly CloudTrail trails charges = $0

Cost of CloudTrail Insights:
CloudTrail Insights events analyzed at $0.35 per 100,000 events = 20,000,000 / 100,000 * $0.35 = $70
Monthly CloudTrail Insights charges = $70
Total monthly CloudTrail charges = $70

Example 6: Import CloudTrail event log from Amazon S3

Assume that you have stored 1 year's worth of CloudTrail events in Amazon S3 and that corresponds to 700 GB of storage. These events are stored in a GZIP (compressed) format. The import feature will first unzip the data, and then import these events to CloudTrail Lake. The unzipped data could be greater than the actual Amazon S3 storage (typically 5-10 times) and hence the actual events metered and imported into Lake will be higher from the stored GZIP in Amazon S3.

Example:
700 GB of Amazon S3 stored events, assuming this results in 7000 GB of events uncompressed and imported.
First 5 TB at $2.5 per GB = $12,800
Next 2 TB at $1 per GB = $2,048
Total CloudTrail Lake Import charges = $12,800 + $2,048 = $14,848.

Note: This pricing uses the same tier as CloudTrail Lake.

Additional pricing resources

AWS Pricing Calculator

Easily calculate your monthly costs with AWS

Get Pricing Assistance

Contact AWS specialists to get a personalized quote

Learn how to get started with AWS CloudTrail

Visit the getting started page
Ready to build?
Get started with AWS CloudTrail
Have more questions?
Contact us