AWS security logging cost follows volume. The main drivers are how many event types you record, how many copies you deliver, how long you keep them and how you query them. Budget by sampling real event counts for a week, choosing data events on purpose, and setting retention per log type. Check current prices on the provider's pages before you commit.
Which logs are we talking about?
This post uses AWS CloudTrail as the anchor, because it is the audit record most compliance programs ask for. The CloudTrail documentation says it logs four types of events: management events, data events, network activity events and Insights events. By default, trails and event data stores log management events but not data or Insights events.
That default matters for cost. Management events cover control plane actions such as creating a user or changing a security group. Data events cover resource operations inside a resource, for example S3 object-level calls. The docs call data events "often high-volume activities". A single busy bucket can generate more data events in a day than an entire account generates management events in a month.
How does AWS charge for it?
I fetched the CloudTrail pricing page on 18 October 2026. Rather than repeat figures that change, here is the structure it describes. Management events get a first copy delivered at no charge, with additional copies charged per volume delivered. Data events are charged per volume delivered. Optional aggregation of data events, which gives 5-minute summaries, is charged by the number of data events analysed. Storage, queries and any downstream tools carry their own charges on their own pricing pages.
So there are four separate cost lines: delivery volume, extra copies, optional analysis features and the cost of storing and querying what you deliver. Read the page for numbers and put the fetch date in your budget document.
How do you estimate without guessing?
Sample, then extrapolate.
- Turn on the event types you plan to record in one representative account for a week.
- Count events per day per type from the delivered files or an event data store query.
- Multiply by the number of accounts of that shape, and add a margin for growth and incident spikes.
- Apply current prices from the provider page to each cost line.
Count peaks separately. A deployment storm or a scanner hitting a bucket can multiply volume for a day. If you budget on the average only, the bill will surprise you in the month you most need the logs.
What should you log on purpose?
Start with the question an auditor or responder will ask. Who changed identities and permissions? Who changed network rules? Who read or deleted objects in the buckets that hold regulated data? The first two are management events and are covered by default. The third needs data events, but only for the specific buckets or tables that matter, not account-wide.
CISA's enhanced visibility guidance for communications infrastructure makes related points that apply broadly: centralise logging so it can be correlated, encrypt log traffic in transit, and store copies off-site so they cannot be modified or deleted by an intruder. It also says logging should take place at all levels of the environment. Treat that last point as a reason to rank, not to log everything.
How does retention change the bill?
Keep recent logs where they can be queried fast and move older logs to cheaper storage. Set the retention period from the longest requirement you actually have, such as a contract or framework clause, not from habit. Write the period next to the data source in your logging inventory so the reason can be audited.
What to do
- Inventory the log sources you need and the question each answers.
- Keep default management event logging on in every account and Region you use.
- Enable data events only for named high-value resources.
- Deliver to a central, access-restricted account so an intruder in a workload account cannot erase the trail.
- Sample a week of volume, add a peak margin, and price it from the live pricing page.
- Set retention per source with the reason recorded.
- Review the budget quarterly against the actual bill.
Quick check
Why do data events change the bill so much?
AWS describes data events as often high-volume. They record operations on or inside resources, such as S3 object calls, so volume scales with traffic, not with administrator activity.
Are management events logged by default?
Yes. The CloudTrail docs say trails and event data stores log management events by default, but not data or Insights events.
Sources
- AWS CloudTrail concepts
- AWS CloudTrail pricing (structure read on 18 October 2026, figures deliberately omitted)
- CISA: Enhanced Visibility and Hardening Guidance for Communications Infrastructure
Last reviewed: 18 October 2026.
