Cloud Trail Data Event costs

Use Amazon Athena to query the CUR data stored in your S3 bucket. Create a new database in Athena:

CREATE DATABASE my_cost_reports;

Create a table in Athena for the CUR data:

CREATE EXTERNAL TABLE IF NOT EXISTS my_cost_reports.cost_usage_report (
    identity_line_item_id string,
    bill_billing_entity string,
    bill_billing_period_start_date string,
    bill_billing_period_end_date string,
    line_item_usage_account_id string,
    line_item_usage_start_date string,
    line_item_usage_end_date string,
    line_item_product_code string,
    line_item_usage_type string,
    line_item_operation string,
    line_item_resource_id string,
    line_item_usage_amount double,
    line_item_unblended_cost double,
    line_item_blended_cost double,
    line_item_unblended_rate double,
    line_item_blended_rate double,
    pricing_unit string,
    reservation_reservation_arn string,
    savings_plan_savings_plan_arn string,
    product_product_name string,
    product_group string,
    product_category string,
    product_usagetype string,
    product_operation string,
    product_servicename string,
    product_region string,
    product_resource_id string,
    product_subscription_id string,
    product_tenant_id string,
    product_capacity_status string,
    product_unit string,
    product_currency string,
    product_description string
)
ROW FORMAT DELIMITED
FIELDS TERMINATED BY ','
STORED AS TEXTFILE
LOCATION 's3://your-bucket-name/path-to-cur/'
TBLPROPERTIES ("skip.header.line.count"="1");

Use the following query to identify which services are causing the increase in CloudTrail costs:

SELECT 
    line_item_product_code AS Service,
    SUM(line_item_unblended_cost) AS TotalCost,
    SUM(line_item_usage_amount) AS UsageAmount
FROM 
    my_cost_reports.cost_usage_report
WHERE 
    line_item_product_code = 'AWSCloudTrail' 
    AND line_item_operation LIKE 'DataEvent%'
GROUP BY 
    line_item_product_code
ORDER BY 
    TotalCost DESC;

To get a more granular view, you can further break down the costs by specific Data Event types:

SELECT 
    line_item_product_code AS Service,
    line_item_operation AS Operation,
    SUM(line_item_unblended_cost) AS TotalCost,
    SUM(line_item_usage_amount) AS UsageAmount
FROM 
    my_cost_reports.cost_usage_report
WHERE 
    line_item_product_code = 'AWSCloudTrail' 
    AND line_item_operation LIKE 'DataEvent%'
GROUP BY 
    line_item_product_code, line_item_operation
ORDER BY 
    TotalCost DESC;

SELECT
  LineItem/LineItemDescription AS Service,
  SUM(LineItem/UnblendedCost) AS TotalCost
FROM
  your-cur-table-name
WHERE
  LineItem/UsageType LIKE 'DataEvent-%'
GROUP BY
  LineItem/LineItemDescription
ORDER BY
  TotalCost DESC;

Replace your-cur-table-name with the actual name of your CUR table.

This query will: Filter the CUR data to only include rows with usage types starting with "DataEvent-" (which represent Cloud Trail events). Group the data by the service name (from the LineItem/LineItemDescription field). Sum the unblended cost for each service. Order the results by the total cost in descending order.