PaidEventsRecorded and DataEventsRecorded - what CloudTrail bills beyond the free trail

What it costs

US East (N. Virginia); other regions differ. Checked 2026-11-11. Sources: AWS CloudTrail pricing, AWS price list file, AWS CloudTrail offer, us-east-1.

Example with made-up numbers

Typical causes

Organization trail plus old account trails

An organization trail was added and the per-account trails from before it were never removed.

A second trail for another tool

A security product or SIEM was given its own trail that records the same management events.

S3 data events on every bucket

Recording object-level events for all buckets turns every GET and PUT into a billed event.

Multi-Region trail plus regional trails

A trail per Region on top of a multi-Region trail records the same events twice.

Find it in your bill

Have a CUR file queryable in Athena? Paste this and run it:

SELECT date_trunc('month', line_item_usage_start_date) AS month,
       line_item_product_code,
       line_item_usage_type,
       line_item_resource_id,
       SUM(line_item_usage_amount)  AS usage_amount,
       SUM(line_item_unblended_cost) AS cost
FROM your_cur_table
WHERE line_item_product_code = 'AWSCloudTrail'
  AND (line_item_usage_type LIKE '%PaidEventsRecorded'
       OR line_item_usage_type LIKE '%DataEventsRecorded')
GROUP BY 1, 2, 3, 4
ORDER BY month DESC, cost DESC
LIMIT 50;

Columns used: line_item_usage_start_date, line_item_product_code, line_item_usage_type, line_item_resource_id, line_item_usage_amount, line_item_unblended_cost.

No CUR file? Use Cost Explorer

1. Open Billing and Cost Management, then Cost Explorer, and set the date range to the last 3 months with Monthly granularity.
2. Set Group by to Usage type.
3. In the Filters panel choose Usage type and tick the entries ending in *PaidEventsRecorded or *DataEventsRecorded (the region prefix, such as USE1-, differs by region).
4. Read the monthly cost per usage type. A line that grows faster than your traffic is the one to chase with the fix below.
5. To see which resource drives it, query the CUR above; resource IDs appear only if your CUR was set up with resource IDs included, otherwise the resource column is empty.

Column names checked against: docs.aws.amazon.com/cur/latest/userguide/Lineitem-columns.html, docs.aws.amazon.com/cur/latest/userguide/cur-ate-run.html.

The fix, step by step

Verify first

Check these before you change anything: the steps below are suggestions, and only you can see your own configuration.

• Ask security or compliance first: a second trail may feed a SIEM, a different S3 account or a regulator-required log, and deleting it ends that feed.
• Keep at least one multi-Region trail recording management events before removing another, or you open a gap in the audit log.
• An organization trail already covers member accounts; per-account trails that record the same events are the duplicates.
• delete-trail does not delete the log files already in S3; they keep costing storage until you remove or expire them.
• Data events you remove stop being recorded; check that no alert or investigation process reads them.

In the console

1. CloudTrail console > Trails; open every trail and note Multi-Region, Organization trail and the Management events setting.
2. Two trails that both record management events in the same Region: only the first copy is free, the second shows up as PaidEventsRecorded.
3. Open a trail > Data events and see which S3 buckets, Lambda functions or tables record data events; remove the ones nobody audits.
4. Keep one multi-Region trail that records management events; for a duplicate trail choose Delete, or edit it and turn Management events off.
5. Confirm in Event history that new management events still appear after the change.

With the CLI

aws cloudtrail describe-trails --include-shadow-trails --query 'trailList[].[Name,HomeRegion,IsMultiRegionTrail,IsOrganizationTrail]' --output table

aws cloudtrail get-event-selectors --trail-name EXAMPLE

aws cloudtrail get-trail-status --name EXAMPLE

aws cloudtrail delete-trail --name EXAMPLE

aws cloudtrail create-trail --name EXAMPLE --s3-bucket-name EXAMPLE-LOG-BUCKET --is-multi-region-trail

aws cloudtrail start-logging --name EXAMPLE

Rollback

Recreate the trail with create-trail and start-logging, or add the event selectors back; events that happened while it was off are not recorded.

Find your CloudTrail lines in your own bill

Drop in your Cost Explorer or CUR CSV. Billtrim reads it in your browser, finds the CloudTrail event lines and shows how many events you pay for.

Get my ranked savings list See a sample result

Paste your export: how to export a Cost Explorer CSV or CUR file in two minutes.

Questions people ask

Is the first trail really free?

Yes: the first copy of management events in each Region is billed at $0.00 (FreeEventsRecorded). Only additional copies appear as PaidEventsRecorded.

Are data events ever free?

No. Data events bill at $0.10 per 100,000 from the first event.

Does Event history cost anything?

No. Event history is available without a trail; a trail is what makes events bill.

Related

• ConfigurationItemRecorded and ConfigRuleEvaluations - what AWS Config bills for
• Requests-Tier1 and Requests-Tier2 - $0.005 per 1,000 PUTs and $0.0004 per 1,000 GETs
• CloudWatch Logs DataProcessing-Bytes: the log ingestion line

Part of the guide: Reduce your AWS bill as a startup: a checklist for teams with no FinOps person