CloudTrail Coverage Calculator

Coverage score = account coverage × 0.6 + region coverage × 0.4, weighting accounts more heavily because an unlogged account is a total blind spot rather than a partial one. The first copy of management events is free, so essentially all CloudTrail cost is data events — S3 object-level and Lambda invocation logging — which is why volume and spend are dominated by that one switch. Coverage is scored separately from volume because the two failure modes are different: a missing account is a gap, a missing region is a gap, and too many data events is only a bill.

CloudTrail is the only record of what happened in an AWS account, it is not retroactive, and the accounts and regions nobody uses are precisely the ones an intruder picks.

This calculator takes 10 inputs: AWS accounts in the organisation, Accounts covered by an organisation trail, Regions with logging enabled, Regions enabled on the account, Management events per day, Data events per day, Average event size, Data event price per 100,000, S3 storage price per GB per month, Log retention. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

No, and you should not. Data events on a busy bucket can be more expensive than the bucket, and they generate volume no human reads. Scope them to buckets holding regulated or credential data, plus any bucket that has ever been public, and rely on management events plus GuardDuty elsewhere.

Because that is where unauthorised activity goes. An attacker with credentials will pick a region your dashboards ignore to spin up compute or exfiltrate data. A multi-region trail costs nothing extra for management events and closes the gap entirely.