CloudWatch log group has no retention policy set
- Severity
- Low
- Service
- CloudWatch
- Check ID
- CLOUDWATCH_LOG_GROUP_NO_RETENTION
What this check finds
Without a retention period, log data is kept indefinitely, increasing storage costs and potentially retaining PII or sensitive operational data longer than required by data governance policies. Most compliance frameworks require log data to be purged after 12–24 months.
Passing looks like: CloudWatch log groups have a retention policy.
How to fix it
Set a retention policy on the log group.
AWS CLI
aws logs put-retention-policy --log-group-name LOG_GROUP_NAME --retention-in-days 365
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
CloudWatch → Log groups → select group → Actions → Edit retention setting.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| HIPAA Security Rule |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs