Question

A company centralizes application logs from dozens of Lambda functions and ECS services into CloudWatch Logs. The compliance team requires that logs be retained for 7 years for audit purposes, but the finance team reports that CloudWatch Logs storage costs have grown significantly because most log groups use the default 'Never expire' retention setting. Engineers only actively query logs from the past 30 days. Which approach minimizes cost while meeting the 7-year retention requirement and preserving query capability for recent logs?

Accepted Answer

Set each log group's retention to 30 days and create a subscription filter to Amazon Data Firehose that delivers all log events to an S3 bucket with a lifecycle policy transitioning objects to S3 Glacier Deep Archive.

Answer

Increase the retention setting on all log groups to 7 years (2557 days) and enable CloudWatch Logs Infrequent Access log class for all groups.

Answer

Set retention to 30 days and rely on CloudWatch Logs automatic archival to S3, which occurs by default when log groups exceed 30 days of retention.

Answer

Export logs to S3 manually with the CreateExportTask API on a monthly schedule using EventBridge Scheduler, then set log group retention to 'Never expire' to avoid data loss during export.