Trino Query Cost Attribution: Joining Event-Listener Logs with S3 Access Logs

Trino does not expose per-query S3 costs natively. But every Trino query that reads Iceberg, Delta, or Hudi data generates S3 GET requests that appear in your access logs under the Trino connector's IAM role. Here is how to join Trino event-listener logs with S3 access logs to attribute query cost per table, per user, and per team.

Why Trino query cost is invisible by default

Trino surfaces query statistics (CPU time, input bytes, input rows) in the Trino UI and via the event listener. But these statistics reflect the data Trino read from its connectors, not the S3 GET requests those reads generated. S3 GET costs are billed separately and are not visible in Trino metrics. The actual cost of a Trino query against an Iceberg table on S3 includes: the S3 GET request cost, the S3 data retrieval cost (if reading from non-STANDARD storage classes), and the compute cost of the Trino cluster.

How Trino reads appear in S3 access logs

When Trino queries an Iceberg table on S3, the Iceberg connector opens GET requests against the table's manifest files and data files using the Trino service's IAM role. These requests appear in S3 access logs with the Trino IAM role ARN as the requester. The object key pattern (the S3 prefix of the table) links each GET request to the specific table being queried.

Joining Trino event logs with S3 access logs

• Enable the Trino HTTP event listener or file-based event listener to capture per-query statistics including start time, end time, user, query ID, and tables accessed
• Join S3 access log GET requests (filtered by Trino role ARN) to query execution windows using the timestamp overlap between query start/end and GET request timestamps
• Group GET requests by table prefix to attribute scan bytes and GET count to each table per query
• Map query user from Trino event logs to the IAM role sessions in S3 access logs via AWS CloudTrail AssumeRole events

Per-user and per-team attribution

Trino's event listener captures the authenticated user identity for each query. When Trino uses IAM role assumption per user or per workgroup, the assumed role session tags appear in CloudTrail. Joining Trino event logs to CloudTrail AssumeRole events and then to S3 access logs gives a complete user-to-query-to-table-to-S3-cost chain.

What reCost provides for Trino observability

• Per-table scan cost from Trino queries, attributed from S3 access logs under the Trino role
• Per-user and per-team Trino query cost breakdown
• Cold partition detection: tables where Trino regularly scans partitions with no recent writes
• Comparison of Trino vs Athena vs Spark scan efficiency per table: which engine reads the same data most efficiently