All checks
Medium
CloudWatch log groups should be retained for a specified time period
Checks that the CloudWatch Logs log group keeps its log events for at least 365 days, the default of AWS's control, so the logs are still there for audits and investigations a year on. A log group that never expires passes; a shorter retention period deletes older events.
- service
- CloudWatch
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
CloudWatch → Logs → Log groups → the log group → Retention setting
- Expire events after
- 365 days (1 year) or longer, or Never expire
With the AWS CLI
aws logs put-retention-policy --log-group-name <log-group-name> --retention-in-days 365 --region <region>With Terraform
resource "aws_cloudwatch_log_group" "this" {
name = var.log_group_name
retention_in_days = 365
}See which of your accounts this check is failing on.
Book a live scan