Explanation
Why the waste happens and who it affects.
In some cases, they are associated with applications or resources that are no longer active. In other cases, the systems may still be running, but the log data is no longer being reviewed, analyzed, or used by any team. Regardless of the reason, retaining logs that no one is monitoring or using results in unnecessary storage costs. If log data is not needed for operational visibility, debugging, compliance, or auditing purposes, it should either be deleted or managed with a shorter retention policy.
CloudWatch Logs stores log data indefinitely by default: every new log group, including those created automatically by Lambda, ECS, EKS, API Gateway, VPC Flow Logs and applications, is set to Never Expire until someone configures a retention period. Active log groups that are still receiving data therefore accumulate archived storage every month even when only the last few days or weeks are ever queried.
Billing model
The pricing dimensions that drive this cost.
CloudWatch Logs are billed on a usage-based model, with charges incurred for:
- Log ingestion
- Cost per GB of log data sent to CloudWatch
- Log storage
- Ongoing cost per GB-month for data retained in log groups, regardless of access or usage
- Log queries and insights
- Additional charges apply when querying or analyzing logs
- Archived log storage
- Billed per GB-month for all data retained in a log group ($0.03 per GB in the CloudWatch pricing examples for US East (N. Virginia))
- Expired events
- Once log events pass the retention setting they are marked for deletion and stop adding to archival storage cost, even if physical deletion takes up to 72 hours
How to detect
9 checks to find it in your estate.
- Identify log groups with significant stored log volume but no recent ingestion activity
- Review historical usage to determine if log data is still being used for operational, security, or compliance purposes
- Evaluate whether the log group is associated with an active application or AWS resource
- Check whether the log group has a defined retention policy or is defaulting to indefinite storage
- Confirm there are no current alerts, dashboards, or queries relying on data within the log group
- Validate with relevant stakeholders (e.g., DevOps, security, compliance) whether the log group is still required
- Run describe-log-groups and list log groups with no retentionInDays value (Never Expire), ranked by storedBytes
- Review log groups whose retention is far longer than any operational, security or compliance requirement
- Check IaC modules and service defaults that create log groups without a retention setting; note that the AWS Config managed rule cw-loggroup-retention-period-check checks for a minimum retention and reports Never Expire log groups as COMPLIANT, so it will not flag this pattern
How to fix
3 ways to remove the waste.
Apply appropriate retention policies to automatically expire old logs or manually delete inactive log groups that are no longer needed. Where appropriate, implement automated cleanup routines to routinely identify and remove unused log groups.
- Set retention on every log group with put-retention-policy, based on how long each log type is actually needed (for example short retention for debug and access logs, longer for audit logs)
- Export or subscribe logs that must be kept long term to Amazon S3 and manage them there with S3 lifecycle rules instead of indefinite CloudWatch retention
- Enforce a retention value at creation time in IaC templates and log group creation automation, since service-created log groups default to Never Expire
Documentation
Vendor references for pricing and configuration.