AWS bill line item
PaidEventsRecorded
A per-100,000-events charge for CloudTrail data events (fine-grained, resource-level API activity such as object reads or function invocations) once data-event logging is turned on for a trail; management events are logged free by default.
CloudTrail data events
Verified against official AWS documentation last checked
Why it shows up
Data events log every individual object- or resource-level API call, not just control-plane changes, so turning them on for a high-traffic bucket or a busy function can generate an enormous, continuously billed event volume compared to the free management-events tier.
The charge multiplies further with multi-region or organization-wide trails that replicate the same data-event logging across every account and region in scope, and can duplicate other access logging already delivering the same information.
How to cut it
- Scope data-event logging to only the specific resources that need object-level audit trails, not "all resources of this type."
- Use advanced event selectors to log only qualifying operations instead of every read/write.
- Avoid duplicating access logging across multiple mechanisms for the same resource.
- Review organization/multi-region trail scope periodically. Logging every account and region by default multiplies cost beyond most audit requirements.
How to read a usage type
PaidEventsRecorded carries no region or direction token, so there's nothing to break down here.
Source
Source: AWS docs →Found PaidEventsRecorded on your own bill?
Drop your Cost Explorer CSV into the AWS Bill Analyzer. It'll flag line items like this one on your own bill and link straight back to the fix.
Analyze your own bill →The invoice is a lagging signal.
A monthly invoice tells you what already happened. CostMon builds a daily baseline, so a spike stands out while you can still act on it.