Excessive CloudTrail Charges from Bulk S3 Deletes

This is especially costly when deleting millions of objects from buckets configured with CloudTrail data event logging at the object level. The resulting volume of logs can cause a significant, unexpected spike in CloudTrail charges, sometimes exceeding the cost of the underlying S3 operations themselves. This inefficiency often occurs when teams initiate bulk deletions for cleanup or cost savings without realizing that CloudTrail logs every API call, including `DeleteObject`, if data event logging is active for the bucket. Expirations performed by S3 Lifecycle rules are not captured as CloudTrail data events, because Lifecycle actions use internal S3 endpoints.

CloudTrail charges based on the volume of management and data events captured; data events delivered by a trail are billed per event ($0.10 per 100,000 data events delivered). When S3 data events are logged, each DeleteObjects record also includes a DeleteObject event for every object it deletes, so one bulk delete request can generate an event per deleted object. S3 data events - especially object-level delete operations-can generate significant logging volume if not scoped or disabled appropriately.

• Review whether CloudTrail data event logging is enabled for S3 buckets targeted for bulk deletes
• Check for a high volume of `DeleteObject` or `DeleteObjects` events in CloudTrail logs
• Validate if logging configuration is necessary for objects being deleted (e.g., legacy or non-sensitive data)

• Temporarily disable S3 data event logging before initiating bulk deletes, only where logging is unnecessary and audit or compliance requirements allow it
• Scope CloudTrail data event logging to only include relevant prefixes or buckets requiring detailed auditability
• Use advanced event selectors to exclude the per-object `DeleteObject` events that CloudTrail adds to each `DeleteObjects` record, or to exclude the target bucket or prefix, instead of turning off data event logging entirely
• Where timing allows, use S3 Lifecycle expiration rules for bulk deletes instead of API-driven deletes; S3 documents that Lifecycle actions are not captured by CloudTrail object-level logging (if a trail does record events from the `s3lifecycle.amazonaws.com` event source, an advanced event selector can exclude them)

• AWS CloudTrail pricingaws.amazon.com
• Logging data eventsdocs.aws.amazon.com
• Filtering data events by using advanced event selectorsdocs.aws.amazon.com
• Amazon S3 CloudTrail eventsdocs.aws.amazon.com
• How S3 Lifecycle interacts with other bucket configurationsdocs.aws.amazon.com
• Deleting a single objectdocs.aws.amazon.com