CloudWatch without retention period specified

This product is not supported for your selected Datadog site. ().

Metadata

Id: ef0b316a-211e-42f1-888e-64efe172b755

Cloud Provider: AWS

Platform: Terraform

Severity: Info

Category: Observability

Learn More

Description

CloudWatch log groups in AWS should explicitly specify the retention_in_days attribute to control how long log data is stored. If this attribute is omitted or set to 0, as shown below, logs are retained indefinitely, increasing storage costs and the risk of sensitive data exposure over time:

resource "aws_cloudwatch_log_group" "example" {
  name = "application-logs"
  retention_in_days = 0
}

A secure configuration, specifying retention_in_days, ensures log data is automatically deleted after the defined period, reducing unnecessary data retention and helping meet compliance requirements:

resource "aws_cloudwatch_log_group" "example" {
  name = "application-logs"
  retention_in_days = 7
}

Compliant Code Examples

resource "aws_cloudwatch_log_group" "negative1" {
  name = "Yada"

  tags = {
    Environment = "production"
    Application = "serviceA"
  }

  retention_in_days = 1
}

Non-Compliant Code Examples

resource "aws_cloudwatch_log_group" "positive1" {
  name = "Yada"

  tags = {
    Environment = "production"
    Application = "serviceA"
  }
}

resource "aws_cloudwatch_log_group" "positive2" {
  name = "Yada"

  tags = {
    Environment = "production"
    Application = "serviceA"
  }

  retention_in_days = 0
}