AWS CloudTrail records two types of events:

  • Management Events:  Represent standard API activity for AWS services. For example, CloudTrail delivers management events for API calls such as launching EC2 instances or creating S3 buckets. The first copy of management events is delivered free of charge. Additional copies of management events are charged at $2.00 per 100,000 events.
  • Data Events:  Represent S3 object-level API activity, such as Get, Put, Delete and List actions. Data events are recorded only for the buckets you specify and are charged at $0.10 per 100,000 events.

There is no charge from AWS CloudTrail for creating a trail. You can look up most management events for the last 7 days in each region without any charges. Learn more.

Example

Your AWS account was configured to deliver management events to two trails and data events to one trail. In a month, you had 150,000 management events and 2M data events. Your charges are calculated as follows:

Charges for the first copy of 150,000 management events = $0 (first copy of management events is free)
Charges for the second copy of 150,000 management events = 150,000 at a price of $2 per 100,000 events = $3
Charges for 2M data events = 2M at a price of $0.10 per 100,000 events = $2


Since CloudTrail delivers logs to S3 bucket, S3 charges will apply based on your usage. Typical S3 charges are less than $3 per month for most accounts.

You can optionally specify an Amazon SNS topic to get notified about CloudTrail log file delivery to S3, send CloudTrail logs to CloudWatch Logs, or encrypt your CloudTrail logs using AWS Key Management Service (KMS). When these features are used, standard usage charges for the related services apply. Please refer to the pricing pages for each service.