Cloud Resource & Cost Impact

21.1 OverviewCopy Anchor Link

Most of what MCM does in your connected accounts is read-only. A small number of features go further — they create a resource directly in your account, or call a metered cloud provider API. This page lists exactly what those are, what they're named, and what they can add to your cloud bill, so you know upfront rather than discovering it later.

This is a companion to Required Permissions — that page covers what access to grant; this one covers what MCM does with it once granted.

21.2 Resources MCM Creates In Your AccountCopy Anchor Link

These four are only created in AWS accounts, and only for the modules listed. Azure accounts have no equivalent — every Azure integration in MCM today is read-only and creates nothing in your subscription.

21.3 What This Means For Your BillCopy Anchor Link

S3 storage grows over timeCopy Anchor Link

Both buckets accumulate data for as long as they exist:

• The CloudTrail logs bucket has no automatic expiration — log files build up indefinitely.
• The CUR bucket receives a fresh export daily; older cost-report files are pruned on a best-effort basis roughly two months later, but there's no guaranteed backstop if that cleanup doesn't run for a given month.

If you want to cap this, apply your own S3 lifecycle rule (e.g. expire objects after 90–180 days) on both mcm-cloudtrail-<your-account-id> and mcm-cur-<your-account-id>.

These resources are not deleted automaticallyCopy Anchor Link

Disabling SecOps or FinOps, or removing the account from MCM entirely, does not delete any of the four resources above. They keep existing — and keep incurring S3 storage cost — until you delete them yourself from the AWS Console or CLI. Use the exact names in the table above to find them.

Ongoing data transfer out of AWSCopy Anchor Link

When Audit Log Security Scanning is active, MCM reads from the CloudTrail bucket roughly every minute, continuously, for as long as the feature stays enabled — not on a daily or hourly schedule. Each read is billed as a normal S3 request, and the log data itself is transferred out of your AWS account to MCM's monitoring infrastructure. On accounts with heavy CloudTrail activity, this ongoing data transfer is typically the largest cost tied to this feature — more than the S3 storage or request costs themselves.

AWS Cost Explorer API usageCopy Anchor Link

FinOps calls the AWS Cost Explorer API, which AWS meters at $0.01 per API request (this is separate from, and in addition to, the free Cost Explorer console):

• Cost forecasting — about once per account per month.
• Reserved Instance and Savings Plan recommendations — run daily, once for every AWS region enabled on the account (typically 15–25 regions). Expect roughly 15–25 metered Cost Explorer requests per day, per connected AWS account, for these two recommendation types combined.

What's not billedCopy Anchor Link

• CloudTrail logging itself — the trail records only management events, not the metered "data events" tier, so it stays within AWS's free allowance for the first trail per region.
• AWS Compute Optimizer, used for Right-Sizing recommendations — no per-call charge from AWS. (If an account isn't enrolled in Compute Optimizer, MCM simply won't produce Right-Sizing recommendations for it — no error, no charge either way. Enroll the account in Compute Optimizer if you want this data.)
• Every current Azure integration — all are free, read-level API calls with no associated Microsoft charge.

21.4 Estimated Monthly Cost (AWS)Copy Anchor Link

These figures apply to AWS accounts only — every current Azure integration is a free, read-level API call with nothing billed by Microsoft.

The unit prices below are verified against AWS's own public pricing data, not estimated — pulled directly from AWS's Price List API (pricing.us-east-1.amazonaws.com) for us-east-1, current as of late September 2026: S3 Standard storage at $0.023/GB-month, S3 PUT/COPY/POST/LIST requests at $0.005 per 1,000, S3 GET/other requests at $0.0004 per 1,000, data transfer out at $0.09/GB (first 10 TB tier, after the shared 100 GB/month free allowance), and the Cost Explorer API at $0.01/request. What's still an estimate is your usage volume — how much of each you actually generate — so treat the totals below as illustrative, not a quote, and check your own AWS Cost Explorer after enabling a module. Prices can also change after this was written; AWS's pricing pages are the source of truth going forward.

Only two modules cause any of this cost today — FinOps and SecOps. Discovery, Governance, and Observability don't create resources or call metered APIs, so they add nothing here (see §21.2). Within FinOps and SecOps, cost is driven by two independent things that don't necessarily move together, so size each against your own account rather than assuming one predicts the other:

• Resource count / account activity — drives CloudTrail log volume, which is what actually grows the SecOps log bucket, the FinOps CUR bucket, and the data crossing AWS's egress boundary.
• Number of enabled AWS regions — drives FinOps's Cost Explorer API calls specifically, independent of how many resources exist in each region.

FinOps — estimated monthly totalCopy Anchor Link

FinOps's cost is dominated by the Cost Explorer API charge at this scale, though CUR storage stops being a rounding error once you're past 50,000 resources — the CUR bucket is (usually) self-pruning, so the Month 12 "worst case" only shows up if that cleanup job never runs for you.

SecOps — estimated monthly totalCopy Anchor Link

At this resource scale, SecOps is the dominant cost, not FinOps — and unlike the small-account numbers, data transfer out is no longer free. Once your CloudTrail volume passes the shared 100 GB/month allowance (which it does well before 10,000 resources at this event rate), every additional GB leaving AWS costs $0.09. See §21.3; adding your own S3 lifecycle rule caps the storage line, but doesn't touch the data-transfer or request lines, since those are driven by the ongoing 1-minute polling, not by how much has accumulated.

Both tables assume roughly 1,000 CloudTrail management events per resource per day (10M / 50M / 100M events/day across the three profiles), at a typical compressed size of about 1 KB/event — this ratio is a proxy, not a measurement, since actual event volume depends more on how automated/active your environment is than on resource count alone. If your account is unusually API-heavy (e.g. heavy CI/CD, auto-scaling, or config-management activity) or unusually quiet, scale these figures up or down accordingly — the safest way to get your real number is to check your CloudTrail bucket's size after your first month.

Both modules enabled togetherCopy Anchor Link

What this excludes: the cost of the AWS resources MCM discovers or helps you manage (your EC2 instances, RDS databases, S3 data, etc.) — this table is only the incremental cost that MCM's own operations add on top of what you already run.

21.5 Summary Checklist Before OnboardingCopy Anchor Link

• Expect two new S3 buckets and one CloudTrail trail to appear in an AWS account once SecOps Audit Log Scanning and/or FinOps are enabled on it.
• Set your own S3 lifecycle rules on mcm-cloudtrail-<your-account-id> and mcm-cur-<your-account-id> if you want them to clean up automatically — MCM does not do this for you.
• If you disable a module or remove an account, manually delete the associated bucket(s) and trail if you no longer want to pay to store their data.
• Budget for a small, predictable Cost Explorer charge (roughly 15–25 requests/day per AWS account) if you use FinOps Recommendations.
• Budget for AWS data-transfer-out charges proportional to your CloudTrail log volume if you enable SecOps Audit Log Security Scanning.