CloudWatch without retention period specified

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-aws-cloudwatch-without-retention-period-specified

Provider: AWS

Platform: Terraform

Severity: Low

Category: Observability

Learn More

Description

CloudWatch log groups in AWS should explicitly specify the retention_in_days attribute to control how long log data is stored. If this attribute is omitted or set to 0, as shown below, logs are retained indefinitely, increasing storage costs and the risk of sensitive data exposure over time:

resource "aws_cloudwatch_log_group" "example" {
  name = "application-logs"
  retention_in_days = 0
}

A secure configuration, specifying retention_in_days, ensures log data is automatically deleted after the defined period, reducing unnecessary data retention and helping meet compliance requirements:

resource "aws_cloudwatch_log_group" "example" {
  name = "application-logs"
  retention_in_days = 7
}

Compliant Code Examples

resource "aws_cloudwatch_log_group" "negative1" {
  name = "Yada"

  tags = {
    Environment = "production"
    Application = "serviceA"
  }

  retention_in_days = 1
}

resource "aws_cloudwatch_log_group" "negative2a" {
  name              = "Yada2a"
  retention_in_days = 1096
}

resource "aws_cloudwatch_log_group" "negative2b" {
  name              = "Yada2b"
  retention_in_days = 2192
}

resource "aws_cloudwatch_log_group" "negative2c" {
  name              = "Yada2c"
  retention_in_days = 2557
}

resource "aws_cloudwatch_log_group" "negative2d" {
  name              = "Yada2d"
  retention_in_days = 2922
}

resource "aws_cloudwatch_log_group" "negative2e" {
  name              = "Yada2e"
  retention_in_days = 3288
}

Non-Compliant Code Examples

resource "aws_cloudwatch_log_group" "positive1" {
  name = "Yada"

  tags = {
    Environment = "production"
    Application = "serviceA"
  }
}

resource "aws_cloudwatch_log_group" "positive2" {
  name = "Yada"

  tags = {
    Environment = "production"
    Application = "serviceA"
  }

  retention_in_days = 0
}