Athena Cost per Table: Attribution Using S3 Access Logs and CloudTrail

Athena charges per byte scanned. But the Athena console only tells you the total per-query scan size, not which table caused it, which team runs the most expensive queries, or which partition is scanned cold every time. S3 access logs give you that attribution layer.

The Athena cost attribution problem

Athena bills at $5 per TB of data scanned. For a team running 50,000 queries per month across 200 tables, the total scan bill is visible in Cost Explorer but the breakdown by table is not. Teams cannot answer 'which table costs us the most to query?' without building a custom attribution layer, or reading S3 access logs.

How S3 access logs attribute Athena queries to tables

Every Athena query generates S3 GET requests against the data it scans, logged under the Athena service principal (athena.amazonaws.com or the query execution IAM role ARN). By joining the GET request log with the S3 object key structure, you can reconstruct which table prefix each query touched, how many bytes it read, and how many GET requests it generated: per query, per day, per team.

• Filter S3 access logs for the Athena service principal or the Athena execution role
• Group GET requests by table prefix (e.g. s3://bucket/warehouse/db/tablename/)
• Sum bytes read and GET count per prefix per time window
• Join with CloudTrail QueryExecutionId to map back to the specific Athena query and user
• Attribute cost as (bytes scanned / 1TB) * $5 per query per table

Cold partition attribution

A partition that is included in every full-table scan but whose data has not changed in 90 days is a cold partition tax. S3 access logs show the GET request pattern per partition prefix. If a partition is being scanned regularly but its objects are never written to, it is cold. Identifying and excluding cold partitions from scan scope (via partition pruning or lifecycle removal) is typically the highest-ROI Athena cost reduction.

Per-team attribution

When teams use separate IAM roles or Athena workgroups, the requester ARN in S3 access logs maps each scan to a team. Combined with table-level attribution, this gives you a cost-per-team-per-table matrix: the data finance view your FinOps team wants but Athena's own tooling does not provide.

What reCost surfaces

• Per-table Athena scan cost in dollars, updated daily from S3 access logs
• Cost breakdown by team (IAM role or workgroup) per table
• Cold partition identification: partitions scanned regularly with no recent writes
• Top 10 most expensive Athena tables per day and per week
• Estimated monthly cost reduction from adding partition filters to the top cold-partition queries