Skip to content
ENExplore Calculators

CloudTrail Coverage Calculator

Measure CloudTrail coverage across accounts and regions, and size management versus data event volume in GB per day with its monthly cost.

About CloudTrail Coverage Calculator

The first copy of management events is free, so essentially all CloudTrail cost is data events — S3 object-level and Lambda invocation logging — which is why volume and spend are dominated by that one switch. Coverage is scored separately from volume because the two failure modes are different: a missing account is a gap, a missing region is a gap, and too many data events is only a bill. CloudTrail is the only record of what happened in an AWS account, it is not retroactive, and the accounts and regions nobody uses are precisely the ones an intruder picks.

Formulas

CloudTrail Coverage

Coverage score = account coverage × 0.6 + region coverage × 0.4, weighting accounts more heavily because an unlogged account is a total blind spot rather than a partial one.

accountCoverage
Accounts in an organisation trail ÷ all accounts × 100
regionCoverage
Regions logged ÷ regions enabled × 100
coverageScore
0–100 weighted coverage

Volume and cost

Log volume in GB/day = (management events + data events) × average event size in KB ÷ 1,048,576. Data events bill at $0.10 per 100,000 delivered.

logGbPerDay
Daily log volume written to S3
dataEventCost
Data events per month ÷ 100,000 × price
storagePricePerGb
S3 Standard storage price per GB per month

Worked example

With the default values below, CloudTrail Coverage Calculator returns CloudTrail Coverage Score of 76.6. Change any input above and every figure here is recalculated in your browser.

Inputs used

AWS accounts in the organisationaccepts 1–100,000 accounts
120 accounts
Accounts covered by an organisation trailaccepts 0–100,000 accounts
112 accounts
Regions with logging enabledaccepts 0–40 regions
17 regions
Regions enabled on the accountaccepts 1–40 regions
33 regions
Management events per dayaccepts 0–100,000,000,000 events
4,200,000 events
Data events per dayaccepts 0–100,000,000,000 events
38,000,000 events
Average event sizeaccepts 0.1–100 KB
1.6 KB
Data event price per 100,000accepts 0–10 USD
0.1 USD
S3 storage price per GB per monthaccepts 0–10 USD
0.023 USD
Log retentionaccepts 1–120 months
12 months

Results

CloudTrail Coverage Score
76.6 / 100
Account Coverage
93.3%
Region Coverage
51.5%
Log Volume
64.39 GB/day
Monthly Log Volume
1,932 GB
Monthly Data Event Charge
$1,140.00
Monthly CloudTrail Cost
$1,184.43
Retained Log Volume
22.64 TB
Accounts With No Trail
8 accounts
Verdict
Accounts outside the organisation trail are invisible — an attacker who lands there leaves no record you can read

Step by step

  1. 1Values used
  2. 2CloudTrail Coverage
  3. 3Volume and cost
  4. 4CloudTrail Coverage Score= 76.6 / 100
  5. 5Account Coverage= 93.3
  6. 6Region Coverage= 51.5
  7. 7Log Volume= 64.39 GB/day
  8. 8Monthly Log Volume= 1,932 GB
  9. 9Monthly Data Event Charge= 1,140.00

Assumptions and limits

  • The result is derived only from the 10 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is CloudTrail Coverage calculated?

Coverage score = account coverage × 0.6 + region coverage × 0.4, weighting accounts more heavily because an unlogged account is a total blind spot rather than a partial one. The first copy of management events is free, so essentially all CloudTrail cost is data events — S3 object-level and Lambda invocation logging — which is why volume and spend are dominated by that one switch. Coverage is scored separately from volume because the two failure modes are different: a missing account is a gap, a missing region is a gap, and too many data events is only a bill.

Why does CloudTrail Coverage matter?

CloudTrail is the only record of what happened in an AWS account, it is not retroactive, and the accounts and regions nobody uses are precisely the ones an intruder picks.

What values do I need to enter?

This calculator takes 10 inputs: AWS accounts in the organisation, Accounts covered by an organisation trail, Regions with logging enabled, Regions enabled on the account, Management events per day, Data events per day, Average event size, Data event price per 100,000, S3 storage price per GB per month, Log retention. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Do I need data events on everything?

No, and you should not. Data events on a busy bucket can be more expensive than the bucket, and they generate volume no human reads. Scope them to buckets holding regulated or credential data, plus any bucket that has ever been public, and rely on management events plus GuardDuty elsewhere.

Why log regions we do not use?

Because that is where unauthorised activity goes. An attacker with credentials will pick a region your dashboards ignore to spin up compute or exfiltrate data. A multi-region trail costs nothing extra for management events and closes the gap entirely.

Related Calculators

CloudTrail Coverage Calculator | Calcrivo