Selective CloudTrail Data Events Logging with Cost Guardrails

Enable CloudTrail Data event logging for sensitive data stores (S3 objects, DynamoDB tables, and Lambda invocations) using Advanced Event Selectors while filtering out benign AWS internal service events to control ingestion costs.

While AWS CloudTrail Management Events capture control-plane operations (e.g., CreateBucket, AttachRolePolicy), they do not record data-plane operations (e.g., S3 GetObject, PutObject, DeleteObject, DynamoDB GetItem, or Lambda Invoke).

1. High-Value Data Plane Auditing

• Data events provide granular forensic trails required to detect unauthorized data exfiltration, insider threats, and ransomware encryption attempts.
• Organizations must enable Data event logging on S3 buckets containing sensitive data (PII, financial data, secret stores) and production DynamoDB tables.

2. Cost & Volume Management via Advanced Event Selectors

• Unfiltered Data event logging across high-throughput data lakes or transient utility buckets causes exponential CloudTrail ingestion and S3 storage costs ($0.10 per 100,000 data events).
• CloudTrail Advanced Event Selectors must be utilized to:
  • Target specific sensitive resource ARNs or prefix patterns.
  • Explicitly exclude AWS service-initiated events (readOnly = true or eventType = AwsServiceEvent) to eliminate repetitive internal read noise.
  • Separate read-only audits from write-only modifications where appropriate.