# Duplicate or overlapping AWS CloudTrail trails Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/duplicate-or-overlapping-aws-cloudtrail-trails AWS CloudTrail enables event logging across AWS services, but when multiple trails are configured to log overlapping events - especially data events -... By: Matt Walls [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Duplicate or Overlapping AWS CloudTrail Trails The short version AWS CloudTrail enables event logging across AWS services, but when multiple trails are configured to log overlapping events - especially data events - it can result in redundant charges and unnecessary storage or ingestion costs. [Matt Walls](https://www.linkedin.com/in/wallsmatthew/) FinOps @ NBCUniversal AWS service [AWS CloudTrail](https://www.pointfive.co/efficiency-hub/cloud-services/aws-cloudtrail) Category [Other](https://www.pointfive.co/efficiency-hub/service-category/other) Reference CER-0016 Type Inefficient Configuration ## Explanation Why the waste happens and who it affects. This commonly occurs in decentralized environments where teams create trails independently, unaware of existing coverage or shared logging destinations.Each trail that records data events contributes to billing on a per-event basis, even if the same activity is logged by multiple trails. Additional costs may also arise from delivering duplicate logs to separate S3 buckets or CloudWatch Log groups. While separate trails may be justified for audit, compliance, or operational segmentation, unintentional duplication increases both cost and operational complexity without added value. ## Billing model The pricing dimensions that drive this cost. CloudTrail billing is driven by: - Management events: One free copy to S3 per region per account - Data events: Charged per event recorded (e.g., object-level access, function invokes) - CloudTrail Insights: Charged per analyzed event - Multiple trails: Additional trails that log the same events or deliver to additional destinations (e.g., CloudWatch Logs) incur cumulative charges Costs scale with both the volume of logged activity and the number of trails capturing it. ## How to detect 5 checks to find it in your estate. - List all CloudTrail trails in the account and examine their configurations - Identify overlapping event types (e.g., same data events logged by multiple trails) - Review whether multiple trails are logging the same resource activity - Check whether each trail's delivery destination (S3, CloudWatch Logs) is unique and necessary - Evaluate whether each trail serves a distinct purpose or is redundant with existing logging ## How to fix 4 ways to remove the waste. - Delete or disable redundant trails that provide no unique audit or compliance value - Consolidate overlapping trails into a single unified configuration where feasible - Use centralized log destinations (e.g., one S3 bucket) to reduce storage and ingestion cost - Document trail ownership and logging strategy across teams to avoid future duplication ## Documentation Vendor references for pricing and configuration. - [AWS CloudTrail Pricing aws.amazon.com](https://aws.amazon.com/cloudtrail/pricing/) - [Understanding Trails in AWS CloudTrail docs.aws.amazon.com](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - AWS CloudTrail CER-0387 ### [Unfiltered CloudTrail Data Event Logging](https://www.pointfive.co/efficiency-hub/inefficiencies/unfiltered-cloudtrail-data-event-logging) CloudTrail data events record resource-level operations such as S3 GetObject and PutObject, Lambda Invoke and DynamoDB item reads and writes. Unlike the first copy of management events, every data event a trail delivers is billed. Security... Other - AWS EventBridge CER-0170 ### [Disabled Retry Policies in EventBridge](https://www.pointfive.co/efficiency-hub/inefficiencies/disabled-retry-policies-in-eventbridge) By default, EventBridge retries delivering an event to a target for up to 24 hours and up to 185 times when targets like Lambda functions or Step Functions fail with retriable errors. However, if a target's retry policy is set to 0... Other - AWS CloudWatch CER-0224 ### [Suboptimal Log Class Configuration in CloudWatch](https://www.pointfive.co/efficiency-hub/inefficiencies/suboptimal-log-class-configuration-in-cloudwatch) By default, CloudWatch Log Groups use the Standard log class, which has a higher per-GB ingestion price. AWS also offers an Infrequent Access (IA) log class designed for logs that are rarely queried - such as audit trails, debugging... Other --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.