Cloud resource and cost impact

OverviewCopy Anchor Link

Most of what MCM does in your connected accounts is read-only. A small number of features go further — they create a resource directly in your account, or call a metered cloud provider API. This page lists exactly what those are, what they're named, and what they can add to your cloud bill, so you know upfront rather than discovering it later.

This is a companion to Required Permissions — that page covers what access to grant; this one covers what MCM does with it once granted.

Resources MCM Creates In Your AccountCopy Anchor Link

These four are only created in AWS accounts, only for the features listed, and only when you choose Let MCM create it. If you choose Use my existing S3 bucket (read-only) or Use the data from another account, MCM creates nothing and only reads. Azure accounts have no equivalent — every Azure integration in MCM is read-only and creates nothing in your subscription, including the Activity Log used by the Audit Log, Audit Log Security Scanning and Inventory Drift.

What This Means For Your BillCopy Anchor Link

S3 storage grows over timeCopy Anchor Link

Both buckets accumulate data for as long as they exist:

• The CloudTrail logs bucket has no automatic expiration by default — log files build up indefinitely.
• The CUR bucket receives a fresh export daily; older cost-report files are pruned on a best-effort basis roughly two months later, but there's no guaranteed backstop if that cleanup doesn't run for a given month.

To cap this for buckets MCM created, turn on auto-delete for the account (off by default): S3 then deletes objects older than the number of days you choose — at least 30 days for CloudTrail, at least 93 days for cost reports, at most 3650. Deleted data cannot be recovered. Auto-delete is never applied to your own existing buckets or to buckets shared from another account; for those, set your own S3 lifecycle rule if you want one.

These resources are not deleted automaticallyCopy Anchor Link

Turning off the Audit Log or FinOps, removing the account from MCM, or changing where an account's CloudTrail or cost report comes from does not delete any of the four resources above. They keep existing — and keep incurring S3 storage cost — until you delete them yourself from the AWS Console or CLI. Use the exact names in the table above to find them.

Ongoing data transfer out of AWSCopy Anchor Link

When the Audit Log is on, MCM reads new log files from the CloudTrail bucket roughly every 30 minutes, continuously, for as long as the feature stays enabled — not on a daily or hourly schedule. The request-cost estimates below were calculated for more frequent reading, so they are conservative. Each read is billed as a normal S3 request, and the log data itself is transferred out of your AWS account to MCM's monitoring infrastructure. On accounts with heavy CloudTrail activity, this ongoing data transfer is typically the largest cost tied to this feature — more than the S3 storage or request costs themselves.

AWS Cost Explorer API usageCopy Anchor Link

FinOps calls the AWS Cost Explorer API, which AWS meters at $0.01 per API request (this is separate from, and in addition to, the free Cost Explorer console):

• Cost forecasting — about once per account per month.
• Reserved Instance and Savings Plan recommendations — run daily, once for every AWS region enabled on the account (typically 15–25 regions). Expect roughly 15–25 metered Cost Explorer requests per day, per connected AWS account, for these two recommendation types combined.

What's not billedCopy Anchor Link

• CloudTrail logging itself — the trail records only management events, not the metered "data events" tier, so it stays within AWS's free allowance for the first trail per region.
• AWS Compute Optimizer, used for Right-Sizing recommendations — no per-call charge from AWS. (If an account isn't enrolled in Compute Optimizer, MCM simply won't produce Right-Sizing recommendations for it — no error, no charge either way. Enroll the account in Compute Optimizer if you want this data.)
• Every current Azure integration — all are free, read-level API calls with no associated Microsoft charge.

Estimated Monthly Cost (AWS)Copy Anchor Link

These figures apply to AWS accounts only — every current Azure integration is a free, read-level API call with nothing billed by Microsoft.

The unit prices below come from AWS's published pricing for the us-east-1 region, as of late September 2026: S3 Standard storage at $0.023/GB-month, S3 PUT/COPY/POST/LIST requests at $0.005 per 1,000, S3 GET/other requests at $0.0004 per 1,000, data transfer out at $0.09/GB (first 10 TB tier, after the shared 100 GB/month free allowance), and the Cost Explorer API at $0.01/request. What is an estimate is your usage volume — how much of each you actually generate — so treat the totals below as illustrative, not a quote, and check your own AWS Cost Explorer after enabling a module. Prices can also change after this was written; AWS's pricing pages are the source of truth going forward.

Only two things cause any of this cost today — FinOps and the Audit Log (which Inventory Drift and SecOps Audit Log Security Scanning build on). Governance, Orchestration and Observability, and the rest of Discovery, don't create resources or call metered APIs, so they add nothing here. Within these, cost is driven by two independent things that don't necessarily move together, so size each against your own account rather than assuming one predicts the other:

• Resource count / account activity — drives CloudTrail log volume, which is what actually grows the CloudTrail log bucket, the FinOps CUR bucket, and the data crossing AWS's egress boundary.
• Number of enabled AWS regions — drives FinOps's Cost Explorer API calls specifically, independent of how many resources exist in each region.

FinOps — estimated monthly totalCopy Anchor Link

FinOps's cost is dominated by the Cost Explorer API charge at this scale, though CUR storage stops being a rounding error once you're past 50,000 resources — the CUR bucket is (usually) self-pruning, so the Month 12 "worst case" only shows up if that cleanup never runs for you.

Audit Log (SecOps and Inventory Drift) — estimated monthly totalCopy Anchor Link

At this resource scale, the Audit Log is the dominant cost, not FinOps — and unlike the small-account numbers, data transfer out is no longer free. Once your CloudTrail volume passes the shared 100 GB/month allowance (which it does well before 10,000 resources at this event rate), every additional GB leaving AWS costs $0.09. Adding your own S3 lifecycle rule caps the storage line, but doesn't touch the data-transfer or request lines, since those are driven by the ongoing polling, not by how much has accumulated.

Both tables assume roughly 1,000 CloudTrail management events per resource per day (10M / 50M / 100M events/day across the three profiles), at a typical compressed size of about 1 KB/event — this ratio is an approximation, since actual event volume depends more on how automated/active your environment is than on resource count alone. If your account is unusually API-heavy (e.g. heavy CI/CD, auto-scaling, or config-management activity) or unusually quiet, scale these figures up or down accordingly — the safest way to get your real number is to check your CloudTrail bucket's size after your first month.

Both modules enabled togetherCopy Anchor Link

What this excludes: the cost of the AWS resources MCM discovers or helps you manage (your EC2 instances, RDS databases, S3 data, etc.) — this table is only the incremental cost that MCM's own operations add on top of what you already run.

Summary Checklist Before OnboardingCopy Anchor Link

• If you choose Let MCM create it, expect two new S3 buckets and one CloudTrail trail to appear in an AWS account once the Audit Log (for Inventory Drift or Audit Log Security Scanning) and/or FinOps are enabled on it. Choose an existing bucket or another account's data to avoid this.
• Turn on auto-delete for MCM-created buckets (or set your own S3 lifecycle rules) if you want them to clean up automatically — it is off by default.
• If you disable a module or remove an account, manually delete the associated bucket(s) and trail if you no longer want to pay to store their data.
• Budget for a small, predictable Cost Explorer charge (roughly 15–25 requests/day per AWS account) if you use FinOps Recommendations.
• Budget for AWS data-transfer-out charges proportional to your CloudTrail log volume if you turn on the Audit Log.