# Amazon CloudWatch Log Group

> A CloudWatch log group bills 2 ways: per GB ingested at write time and per GB-month stored, with retention defaulting to never-expire. ZopNight discovers log groups through a dedicated provider and flags groups with no retention policy plus Standard-class groups that qualify for the cheaper Infrequent Access class.

Source: https://zop.dev/integrations/aws/cloudwatch-logs
Updated: 2026-08-19

---

A CloudWatch log group collects log streams from applications and AWS services, billed per GB ingested and per GB-month stored. Log groups default to never-expire retention, so verbose logging compounds into significant storage cost over time.

## Ingest bills once; storage bills forever

Ingestion bills per GB at write time. Every log line pays once on the way in. Storage then bills per GB-month for as long as the data is retained, and the default retention is never-expire, so a log group's storage meter grows monotonically until someone sets a policy. The Infrequent Access log class offers a lower ingestion rate in exchange for fewer query features, which suits logs kept for audit rather than live debugging. Data transfer and Logs Insights queries meter separately, but ingestion and storage dominate most bills.

## Retention is a decision nobody made

The waste here is almost all defaults. Groups with no retention policy carrying years of debug output at the full storage rate. Verbose non-production logging (debug level switched on during an incident and never off), paying the ingestion meter every hour since. And Standard-class groups whose logs are written once and read never, where Infrequent Access would ingest the same bytes cheaper.

## The two levers

Both meters respond only to configuration. A retention policy caps the storage meter by deleting aged events on a rolling basis; class selection and log-level discipline reduce the ingestion meter. There is nothing to stop or schedule: a log group with no writes and no stored data already costs nothing.

## How coverage works

Log groups are discovered through a dedicated provider on the 6-hour cycle, with ingestion and storage cost from Cost Explorer or CUR 2.0. Recommendations flag missing retention policies, Infrequent Access candidates, and ingest-volume outliers.

## Where retention hides in the console

CloudWatch console, then Logs, then Log groups. The Retention column reads Never expire on every unconfigured group; the column is sortable, and the list is usually long. Setting a policy starts rolling deletion from that point on.