This recommendation identifies management events that are delivered for both member accounts and management accounts, as these will incur duplicated charges. We therefore suggest terminating trails associated with the member account.
The managed event are identified per linked account and region, the recommendation isn't triggered on the trail level.

• The Recommendation for AWS CloudTrail identifies excessive Trails per member payer account and suggests their termination.
• The identification and savings calculation is grouped per linked account and region, the recommendation isn't triggered on the trail level.
• The identification and savings calculation is done where: Service='AWS CloudTrail' and Usage Type contain 'PaidEventsRecorded'.

N/A

Umbrella.

No.

cloudTrail:DescribeTrails

To enable CloudTrail recommendations, make sure to add the following permission to each of the linked accounts. This is also part of the Account->Policies json file.