CloudTrail, AWS Config and security services pricing

CloudTrail pricing starts only beyond the free event history and the first copy of management events: per 100,000 events for further copies, for data events and for Insights, and per GB for ingestion, retention and queries in CloudTrail Lake; AWS Config charges per configuration item recorded and per rule evaluation, GuardDuty per million events analysed and per GB of logs analysed or per vCPU monitored, Security Hub per security check and per finding ingested, KMS per key and month plus per 10,000 requests, and Secrets Manager per secret and month plus per 10,000 API calls. On the bill, AWS Config through its rule evaluations and GuardDuty through the logs it analyses dominate in most accounts, while CloudTrail becomes a line only with data events on heavily used buckets.

Pricing dimensions

The six services count events: recorded, evaluated, analysed, checked, encrypted and retrieved, per account and region, and their prices are small per unit and large per month, because the units run into the millions. Every item carries its own usage type, and none of the services has a purchase option.

CloudTrail is free in its basic form: the event history of the last 90 days and one copy of the management events into a bucket cost nothing, and what costs is everything beyond, a second copy per account beside the organisation trail, data events on buckets and functions with many accesses, and Insights. CloudTrail Lake is the event data store with prices of its own per GB for ingestion, retention and queries, which gets dear with the volume of data events. AWS Config counts two things: configuration items, one per change of every resource or one per day with daily recording, and rule evaluations, one per resource and rule on every change; an account with many rules on many resources that change often, through auto scaling for instance, produces millions of evaluations a month.

GuardDuty charges per protection plan the volume it analyses: CloudTrail events per million, VPC Flow Logs and DNS logs per GB in falling tiers, S3 data events per million, EKS audit logs per million, runtime monitoring per vCPU and month, malware protection per GB scanned and RDS protection per vCPU or ACU; the flow logs are the largest line in most accounts, and GuardDuty reads them without them having to sit in CloudWatch or S3. Security Hub charges security checks per resource and standard in tiers and the ingestion of third-party findings above an allowance, plus the Essentials plan per monitored resource and hour. KMS charges every customer key per month and region, every version up to the second on rotation, and requests per 10,000 by kind; the services' AWS-managed keys cost nothing. Secrets Manager charges every secret per month and every retrieval per 10,000, and an application that reads the secret on every invocation instead of caching it makes the retrievals the larger line. The mechanics across all three providers are in identity and security services.

How it appears in your billing data

In the Cost and Usage Report the lines carry the service's product code, AWSCloudTrail, AWSConfig, AmazonGuardDuty, AWSSecurityHub, awskms and AWSSecretsManager, and the usage type's prefix is the region code, EUC1 for Frankfurt, on KMS in the long form eu-central-1. CloudTrail appears as EUC1-FreeEventsRecorded at 0 and EUC1-PaidEventsRecorded for further copies, EUC1-DataEventsRecorded for data events, EUC1-InsightsEvents, EUC1-NetworkEventsRecorded, and for Lake EUC1-Ingestion-Bytes with tiers, EUC1-Ingestion-Bytes-1yearstore-Live-CloudTrail-Logs for one-year retention, EUC1-PaidStorage-ByteHrs and EUC1-QueryScanned-Bytes; lineItem/ResourceId names the trail or the event data store. Config appears as EUC1-ConfigurationItemRecorded and EUC1-ConfigurationItemRecordedDaily, EUC1-ConfigRuleEvaluations with tiers, EUC1-ConformancePackEvaluations and EUC1-ProactiveConfigRuleEvaluations, without a resource, because the count runs per account and region.

GuardDuty appears per source as EUC1-PaidEventsAnalyzed for CloudTrail events, EUC1-PaidEventsAnalyzed-Bytes for flow and DNS logs with tiers, EUC1-PaidS3DataEventsAnalyzed, EUC1-PaidKubernetesAuditLogsAnalyzed, EUC1-PaidEC2vCPUMonitored, EUC1-PaidEKSvCPUMonitored and EUC1-PaidFargatevCPUMonitored for runtime monitoring, EUC1-PaidMalwareProtectionEBSDataScanned and EUC1-PaidRDSvCPUMonitored, with Free variants at 0 during the trial. Security Hub appears as EUC1-PaidComplianceCheck with tiers and EUC1-OtherProduct:PaidFindingsIngestion above the allowance, the Essentials plan as EUC1-MonitoredEC2, EUC1-MonitoredFunction and EUC1-MonitoredContainerImage per hour. KMS appears as eu-central-1-KMS-Keys per key version and eu-central-1-KMS-Requests with variants for asymmetric requests and key pairs, the allowance as Global-KMS-Requests; Secrets Manager as EUC1-AWSSecretsManager-Secrets and EUC1-AWSSecretsManagerAPIRequest.

What the reports do not deliver is attribution per resource or team: Config and GuardDuty count per account and region, KMS per key, and the originators show only in the services themselves, in Config's advanced query by resource type, in GuardDuty's usage statistics per data source and account, in CloudTrail Lake's metrics per data store. The report's structure is described in the AWS Cost and Usage Report. In the FOCUS export, ServiceName carries the service's name and x_ServiceCode the product code; every item is ChargeCategory Usage (FOCUS columns).

Levers

Configuration: on Config the recording scope is the first lever, because every configuration item and every evaluation counts: resource types that change often and need no rule are excluded, daily recording replaces continuous where changes are not needed one by one, and rules are evaluated periodically instead of on every change where that suffices. On CloudTrail the data events are the lever: only the buckets and functions an audit purpose demands, with selectors instead of all; and an organisation trail instead of a trail per account, because the first copy per account is free and every further one costs. On GuardDuty the protection plans per account are the lever, because every plan pays its volume and runtime monitoring runs per vCPU; on KMS the number of customer keys and the caching of data keys, which avoids requests; on Secrets Manager the caching of secrets in the application.

Purchase option: there is none for any of the six services; the tiers on Config, GuardDuty and Security Hub apply by themselves with volume.

Architecture: the security services' logs belong in S3, not in CloudWatch Logs, because CloudTrail and Config deliver there free of charge and CloudWatch charges per GB (CloudWatch pricing, S3 pricing); queries run through Athena on the bucket instead of CloudTrail Lake, where ingestion per GB costs several times S3 storage. One key per application instead of per resource keeps the KMS line small, and data key caching in the SDK keeps the requests small. What security costs is mostly not the service but the volume it reads; the volumes sit with the services that produce them.

Where it goes wrong

• Config pays for auto scaling. Every change of an instance or a volume is a configuration item and triggers every rule on it. ConfigurationItemRecorded and ConfigRuleEvaluations rise with scaling; excluding ephemeral types or daily recording ends it.
• The second trail costs. An organisation trail and a trail per account deliver the management events twice. PaidEventsRecorded is the clue; the organisation trail alone suffices.
• Data events on the log bucket. Data events on a bucket written to every second pay per 100,000 object accesses. DataEventsRecorded per trail shows it; selectors on the buckets an audit purpose demands end it.
• GuardDuty reads every flow. VPC Flow Logs of an account with much east-west traffic pay per GB. PaidEventsAnalyzed-Bytes per account shows it; the tiers lower the rate, and an account without a workload does not need the plan.
• Runtime monitoring on every vCPU. The agent pays per vCPU and month on every node, in development clusters too. The plans apply per account; development and production accounts do not need the same ones.
• The application reads the secret on every invocation. Retrievals per 10,000 exceed the secrets per month. AWSSecretsManagerAPIRequest against the number of secrets shows it; a cache in the SDK ends it.
• Rotation multiplies the key. A rotated KMS key costs per version up to the second, that is up to three times. KMS-Keys counts versions, not keys.

Example

List prices in USD for Frankfurt (eu-central-1), read on 2026-10-21 from the AWS price list: CloudTrail costs USD 2.00 per 100,000 management events of every further copy, USD 0.10 per 100,000 data events and USD 0.35 per 100,000 for Insights; CloudTrail Lake USD 2.50 per GB of ingestion for the first 5 TB, USD 1.00 up to 25 TB and USD 0.50 beyond, USD 0.75 per GB with one-year retention, USD 0.023 per GB-month of extended retention and USD 0.005 per GB scanned. Config costs USD 0.003 per configuration item, USD 0.012 per item recorded daily, USD 0.001 per rule evaluation for the first 100,000, USD 0.0008 for the next 400,000 and USD 0.0005 beyond. GuardDuty costs USD 4.60 per million CloudTrail events, USD 1.15 per GB of flow and DNS logs for the first 500 GB, USD 0.58 up to 2.5 TB, USD 0.29 up to 10 TB and USD 0.17 beyond, USD 1.04 per million S3 data events, USD 1.92 per vCPU-month of runtime monitoring for the first 500 vCPU, USD 0.04 per GB of malware scanning. Security Hub costs USD 0.001 per security check for the first 100,000 and USD 0.00003 per finding ingested above 10,000. KMS costs USD 1.00 per key version and month and USD 0.03 per 10,000 symmetric requests after 20,000 free; Secrets Manager USD 0.40 per secret and month and USD 0.05 per 10,000 API calls.

An account with 2,000 recorded resources that change five times a month on average and 20 rules per resource produces 10,000 configuration items for USD 30.00 and 200,000 rule evaluations for 100.00 plus 80.00 = USD 180.00, USD 210.00 in all; with daily recording 2,000 × 30 × 0.012 = USD 720.00 for the items and as many evaluations, which is why the daily form saves only on resources with many changes a day. The same account with an organisation trail and data events on a bucket with 50 million accesses a month pays USD 50.00 for the data events and nothing for the management events; a second trail per account with 5 million management events pays USD 100.00. GuardDuty on 10 million CloudTrail events, 500 GB of flow logs and 100 vCPU of runtime monitoring costs 46.00 plus 575.00 plus 192.00 = USD 813.00. Twenty KMS keys with 10 million requests cost 20.00 plus 29.94 = USD 49.94, 100 secrets with a million retrievals 40.00 plus 5.00 = USD 45.00. The figures show that Config and GuardDuty are the lines that grow with the account, that the flow logs on GuardDuty cost three times the events, and that CloudTrail costs nothing without data events and second copies.

Sources

Read on 2026-10-21. Prices: AWS CloudTrail pricing, AWS Config pricing, Amazon GuardDuty pricing, AWS Security Hub pricing, AWS KMS pricing, AWS Secrets Manager pricing, AWS Price List for eu-central-1: AWSCloudTrail, AWSConfig, AmazonGuardDuty, AWSSecurityHub, awskms, AWSSecretsManager. Billing data: Cost and Usage Report columns: lineItem, FOCUS 1.0 with AWS columns.