# Overly permissive VPC flow log filters sent to CloudWatch logs Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/overly-permissive-vpc-flow-log-filters-sent-to-cloudwatch-logs VPC Flow Logs configured with the ALL filter and delivered to CloudWatch Logs often result in unnecessarily high log ingestion volumes - especially in... By: Kevin Talbierz Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Overly Permissive VPC Flow Log Filters Sent to CloudWatch Logs The short version VPC Flow Logs configured with the ALL filter and delivered to CloudWatch Logs often result in unnecessarily high log ingestion volumes - especially in high-traffic environments. [Kevin Talbierz](https://www.linkedin.com/in/kevin-talbierz/) FinOps Manager @ Accor AWS service [AWS CloudWatch](https://www.pointfive.co/efficiency-hub/cloud-services/aws-cloudwatch) Category [Other](https://www.pointfive.co/efficiency-hub/service-category/other) Reference CER-0233 Type Excessive Ingestion or Processing ## Explanation Why the waste happens and who it affects. This setup is rarely required for day-to-day monitoring or security use cases but is commonly created with the ALL filter by templates or landing zone baselines, or for temporary debugging, and then left in place. As a result, teams incur excessive CloudWatch charges without realizing the logging configuration is misaligned with actual needs. ## Billing model The pricing dimensions that drive this cost. CloudWatch Logs is billed based on: Ingestion volume (per GB) - flow logs are billed as vended logs, at volume-tiered per-GB rates that depend on the destination (CloudWatch Logs, Amazon S3, or Amazon Data Firehose) Storage (per GB per month) - ongoing charges for retained logs ## How to detect 5 checks to find it in your estate. - Identify VPC Flow Logs with a destination of CloudWatch Logs - Check whether the log filter is set to ALL - Review total ingestion volumes and associated CloudWatch Logs charges over time - Evaluate whether full traffic logging is necessary or if ACCEPT or REJECT would suffice - Confirm whether logs are used for active monitoring or compliance, or are remnants of prior debugging ## How to fix 4 ways to remove the waste. - Delete and recreate the flow log with an ACCEPT or REJECT filter (or a reduced custom record format) where appropriate, since a flow log's configuration cannot be changed after it is created - Consider redirecting logs to S3 for lower-cost storage if detailed analysis is not required in CloudWatch - Implement periodic audits of logging configurations to catch overly verbose setups - Align logging retention and granularity with actual monitoring and compliance needs ## Documentation Vendor references for pricing and configuration. - [Logging IP traffic using VPC Flow Logs docs.aws.amazon.com](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) - [Flow log limitations - Amazon Virtual Private Cloud docs.aws.amazon.com](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-limitations.html) - [Amazon CloudWatch Pricing aws.amazon.com](https://aws.amazon.com/cloudwatch/pricing/) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - AWS CloudWatch CER-0379 ### [High-Cardinality Custom Metrics in CloudWatch](https://www.pointfive.co/efficiency-hub/inefficiencies/high-cardinality-custom-metrics-in-cloudwatch) A classic CloudWatch metric is identified by its namespace, name and dimensions, and CloudWatch treats every unique combination of dimension values as a separate metric. Each of those is billed as a custom metric for every hour it receives... Other - AWS CloudWatch CER-0380 ### [Excessive CloudWatch GetMetricData API Polling by Monitoring Tools](https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-cloudwatch-getmetricdata-api-polling-by-monitoring-tools) Third-party observability platforms, open source exporters and in-house scripts usually collect AWS metrics by calling the CloudWatch GetMetricData API on a schedule. GetMetricData is billed by the number of metrics requested and, unlike... Other - AWS CloudWatch CER-0224 ### [Suboptimal Log Class Configuration in CloudWatch](https://www.pointfive.co/efficiency-hub/inefficiencies/suboptimal-log-class-configuration-in-cloudwatch) By default, CloudWatch Log Groups use the Standard log class, which has a higher per-GB ingestion price. AWS also offers an Infrequent Access (IA) log class designed for logs that are rarely queried - such as audit trails, debugging... Other --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.