# AWS CloudTrail (Account)

> CloudTrail's first copy of management events is free per account; additional trails, data events, and CloudTrail Lake each carry their own charges. ZopNight tracks CloudTrail cost at the account level, flags duplicate trails and broad data-event logging, and uses LookupEvents (capped at 10k events, 2 TPS) for its activity timeline.

Source: https://zop.dev/integrations/aws/cloudtrail-account
Updated: 2026-08-19

---

AWS CloudTrail records API activity across an AWS account, with charges for additional trails, data events, and CloudTrail Lake. Duplicate trails and broad data-event logging are common sources of surprise CloudTrail cost.

## Free once, billed twice

CloudTrail's pricing hinges on copies. The first delivery of management events in each account is free; a second trail delivering the same events bills per 100,000 events. Data events, the high-volume records of S3 object operations and Lambda invocations, are never free and bill per 100,000 events from the first one, which is why enabling them "for all buckets" transforms CloudTrail from a free service into a real line item overnight. CloudTrail Lake adds its own ingestion and storage meters for queryable event stores.

## Account-level tracking and the activity timeline

ZopNight handles CloudTrail through a dedicated account-level provider rather than per-resource discovery. Cost comes from Cost Explorer or CUR 2.0, with recommendations aimed at the two classic overspends: duplicate trails capturing the same management events twice, and data-event logging scoped far wider than any consumer of those events needs. CloudTrail also serves ZopNight as a data source. LookupEvents supplies the write-event history behind the resource activity timeline, capped at 10k events per resource and throttled to 2 TPS to stay inside API limits.

## How trails multiply

Organization trails plus lingering per-account trails are the standard duplication: the org-wide trail arrives, nobody deletes the account-local ones, and every account pays for its second copy. Security tooling contributes: a SIEM integration creates its own trail rather than reading the existing one. And data events get switched on during an investigation ("log all S3 access"), then survive the investigation by years.

## Untangling it in the console

The CloudTrail console's Trails view shows every trail, its region scope, and whether it captures management events, data events, or both. Duplicated management-event coverage is visible directly. For data events, the event selectors on each trail show the scoping, and narrowing them to the buckets and functions someone actually audits is usually the whole fix.