CloudWatch log group expires audit history before 12 months
- Severity
- Medium
- Service
- CloudWatch
- Check ID
- CLOUDWATCH_LOG_GROUP_RETENTION_TOO_SHORT
What this check finds
The log group has a retention policy shorter than 365 days, so audit history is deleted before the period most frameworks require. PCI-DSS 10.5.1 requires at least 12 months of audit log history, with the most recent three months immediately available. An investigation that reaches back further than the logs do cannot be completed, and the evidence is already gone by the time anyone looks.
Passing looks like: CloudWatch log groups retain at least 12 months of history.
How to fix it
Raise the retention period to 365 days or more.
AWS CLI
aws logs put-retention-policy --log-group-name LOG_GROUP_NAME --retention-in-days 365
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
CloudWatch -> Log groups -> select group -> Actions -> Edit retention setting. Where cost is a concern, export older logs to S3 with a lifecycle policy rather than shortening retention.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| PCI-DSS v4.0.1 |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs