Finding source of expensive ListBuckets operations

Question

I've got a relatively high expense line item in my monthly costs for S3. When I look at the "operation" it is dominated by the "ListBuckets" call.

I'm trying to figure out where that is coming from. The default CloudTrail history shows some calls but not enough to create a high cost.

Any suggestions on how to dive the next level deeper to investigate this?

Answer

You can use [AWS Cost Explorer](https://aws.amazon.com/aws-cost-management/aws-cost-explorer/) and narrow down to the application making the 'ListObjects' API calls, provided you are using '[tags](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html)' effectively to identify different workloads/applications. 
From AWS Cost Explorer, select and filter by S3 service, next filter by 'ListBucket' API Operation from the drop down, and then in the last, in 'Group by' section, filter by 'Tag'.

Other option is you can use [AWS CloudTrail Lake](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html) for your investigation. AWS CloudTrail Lake offers  deeper and more customizable view of events.

You can also use [AWS Cost and Usage Reports ](https://docs.aws.amazon.com/cur/latest/userguide/what-is-cur.html) to dive deeper to identify spend at resource/API level.

Finding source of expensive ListBuckets operations

Relevant content