Size CloudTrail data event charges, compressed S3 storage across a retention window, extra trail copies and Lake ingestion.
CloudTrail gives you one free copy of management events per account, so the cost almost always comes from data events, which fire once per S3 object or Lambda invocation and can be thousands of times more numerous. Storage grows linearly until the retention window fills, so the steady-state figure is the monthly volume multiplied by the retention months, not just one month. Confirm the current data event and Lake prices for your region. Turning on S3 data events across every bucket is the classic way to add a four-figure monthly line item overnight — scoping them to the buckets and prefixes that actually need an audit trail is what keeps CloudTrail affordable.
CloudTrail Storage
cost = data events ÷ 100,000 × event price + extra trails × management events ÷ 100,000 × copy price + compressed GB held × S3 price, plus Lake ingestion if enabled.
Retention accumulation
steady-state GB = total events × event KB ÷ 1,048,576 × compressed share × retention months.
cost = data events ÷ 100,000 × event price + extra trails × management events ÷ 100,000 × copy price + compressed GB held × S3 price, plus Lake ingestion if enabled. CloudTrail gives you one free copy of management events per account, so the cost almost always comes from data events, which fire once per S3 object or Lambda invocation and can be thousands of times more numerous. Storage grows linearly until the retention window fills, so the steady-state figure is the monthly volume multiplied by the retention months, not just one month. Confirm the current data event and Lake prices for your region.
Turning on S3 data events across every bucket is the classic way to add a four-figure monthly line item overnight — scoping them to the buckets and prefixes that actually need an audit trail is what keeps CloudTrail affordable.
This calculator takes 11 inputs: Data events per month, Management events per month, Additional trails beyond the first, Average event record size, Retention in S3, Compressed size as a share of raw, Also ingest into CloudTrail Lake, Data event price per 100,000 events, Extra-copy management event price per 100,000, S3 storage price per GB-month, CloudTrail Lake ingestion price per GB. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Volume. Management events are control-plane calls, typically thousands a day. Data events are per object or per invocation, so a single busy bucket or a Lambda handling millions of requests generates orders of magnitude more records — and there is no free copy for them.
Lake charges a high per-GB ingestion fee but gives SQL over a managed, immutable store with its own retention. Querying the raw S3 JSON with Athena is far cheaper to store and lets you keep the data in your own lifecycle policy, at the cost of building the table and partitions yourself.