CloudWatch log groups that never expire

What this problem is

Every CloudWatch log group has a retention setting, and its default value is "never expire". Anyone creating a log group without setting it — which includes virtually every log group created automatically by Lambda, ECS, API Gateway or VPC Flow Logs — is asking for perpetual storage without realising it.

The cost has two parts: ingestion, billed once per gigabyte that arrives, and storage, billed every month on everything that has ever arrived. You pay ingestion either way; storage is what accumulates. A service producing a gigabyte of logs a day accumulates three hundred and sixty-five gigabytes a year, and in year two is still paying for year one's.

The question that settles it is how long those logs are genuinely consulted. Application logs tend to be useful for weeks — past that, anyone who needs them will look somewhere else. Logs that must be kept for years to satisfy a regulator have a better home: exported to S3 in a cold storage class, they cost a fraction of the price.