# Excessive CloudTrail charges from bulk S3 deletes Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-cloudtrail-charges-from-bulk-s3-deletes When large numbers of objects are deleted from S3 - such as during scripted cleanups or batch jobs that call DeleteObject or DeleteObjects-CloudTrail... By: Liam Greenamyre Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Excessive CloudTrail Charges from Bulk S3 Deletes The short version When large numbers of objects are deleted from S3 - such as during scripted cleanups or batch jobs that call DeleteObject or DeleteObjects-CloudTrail can log every individual delete operation if data event logging is enabled. [Liam Greenamyre](https://www.linkedin.com/in/liam-greenamyre-01606310/) Principal Product Manager (Technical - External Services) @ Amazon Web Services (AWS) AWS service [AWS S3](https://www.pointfive.co/efficiency-hub/cloud-services/aws-s3) Category [Storage](https://www.pointfive.co/efficiency-hub/service-category/storage) Reference CER-0054 Type Inefficient Configuration ## Explanation Why the waste happens and who it affects. This is especially costly when deleting millions of objects from buckets configured with CloudTrail data event logging at the object level. The resulting volume of logs can cause a significant, unexpected spike in CloudTrail charges, sometimes exceeding the cost of the underlying S3 operations themselves. This inefficiency often occurs when teams initiate bulk deletions for cleanup or cost savings without realizing that CloudTrail logs every API call, including \`DeleteObject\`, if data event logging is active for the bucket. Expirations performed by S3 Lifecycle rules are not captured as CloudTrail data events, because Lifecycle actions use internal S3 endpoints. ## Billing model The pricing dimensions that drive this cost. CloudTrail charges based on the volume of management and data events captured; data events delivered by a trail are billed per event ($0.10 per 100,000 data events delivered). When S3 data events are logged, each DeleteObjects record also includes a DeleteObject event for every object it deletes, so one bulk delete request can generate an event per deleted object. S3 data events - especially object-level delete operations-can generate significant logging volume if not scoped or disabled appropriately. ## How to detect 3 checks to find it in your estate. - Review whether CloudTrail data event logging is enabled for S3 buckets targeted for bulk deletes - Check for a high volume of \`DeleteObject\` or \`DeleteObjects\` events in CloudTrail logs - Validate if logging configuration is necessary for objects being deleted (e.g., legacy or non-sensitive data) ## How to fix 4 ways to remove the waste. - Temporarily disable S3 data event logging before initiating bulk deletes, only where logging is unnecessary and audit or compliance requirements allow it - Scope CloudTrail data event logging to only include relevant prefixes or buckets requiring detailed auditability - Use advanced event selectors to exclude the per-object \`DeleteObject\` events that CloudTrail adds to each \`DeleteObjects\` record, or to exclude the target bucket or prefix, instead of turning off data event logging entirely - Where timing allows, use S3 Lifecycle expiration rules for bulk deletes instead of API-driven deletes; S3 documents that Lifecycle actions are not captured by CloudTrail object-level logging (if a trail does record events from the \`s3lifecycle.amazonaws.com\` event source, an advanced event selector can exclude them) ## Documentation Vendor references for pricing and configuration. - [AWS CloudTrail pricing aws.amazon.com](https://aws.amazon.com/cloudtrail/pricing/) - [Logging data events docs.aws.amazon.com](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) - [Filtering data events by using advanced event selectors docs.aws.amazon.com](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/filtering-data-events.html) - [Amazon S3 CloudTrail events docs.aws.amazon.com](https://docs.aws.amazon.com/AmazonS3/latest/userguide/cloudtrail-logging-s3-info.html) - [How S3 Lifecycle interacts with other bucket configurations docs.aws.amazon.com](https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-and-other-bucket-config.html) - [Deleting a single object docs.aws.amazon.com](https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-objects.html) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - AWS S3 CER-0229 ### [Excessive KMS Charges from Missing S3 Bucket Key Configuration](https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-kms-charges-from-missing-s3-bucket-key-configuration) S3 buckets configured with SSE-KMS but without Bucket Keys generate a separate KMS request for each object operation. This behavior results in disproportionately high KMS request costs for data-intensive workloads such as analytics,... Storage - AWS S3 CER-0076 ### [Missing S3 Lifecycle Policy for Incomplete Multipart Uploads](https://www.pointfive.co/efficiency-hub/inefficiencies/missing-s3-lifecycle-policy-for-incomplete-multipart-uploads) Multipart upload allows large files to be uploaded in segments. Each part is stored individually until the upload is finalized by a "CompleteMultipartUpload" request. If this final request is never issued-due to a timeout, crash, failed... Storage - AWS S3 CER-0032 ### [Delayed Transition of Objects to Intelligent-Tiering in an S3 Bucket](https://www.pointfive.co/efficiency-hub/inefficiencies/delayed-transition-of-objects-to-intelligent-tiering-in-an-s3-bucket) Some S3 lifecycle policies are configured to transition objects from Standard storage to Intelligent-Tiering after a fixed number of days (e.g., 30 days). This creates a delay where objects reside in S3 Standard, incurring higher storage... Storage --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.