Question

A company centralizes application logs in a CloudWatch Logs log group configured with a 30-day retention period. A new compliance requirement mandates that these logs be retained for 7 years for potential audit, but they will rarely be queried after 90 days. The security team wants to meet the retention requirement while minimizing storage cost. Which approach best satisfies these requirements?

Accepted Answer

Create a subscription filter that streams the log group to Amazon Kinesis Data Firehose, delivering logs to an S3 bucket with lifecycle policies transitioning to Glacier, while keeping the 30-day CloudWatch retention.

Answer

Change the log group retention setting to 7 years so CloudWatch Logs stores all data for the full period.

Answer

Enable CloudWatch Logs export to S3 manually once and rely on the export for all future logs.

Answer

Increase the retention to 90 days and enable CloudWatch Logs Insights to archive queries automatically after that period.