CloudWatch Logs Are Eating Your Budget: A Cost Optimization Guide
CloudWatch is one of the sneakiest AWS cost drivers. Learn about log ingestion, retention, and cross-region transfer costs—plus how to cut them by 50-80%.
CloudWatch Logs Are Eating Your Budget
The silent cost driver nobody warned you about
You set up CloudWatch logging because that's what AWS recommends. You enabled it on your Lambda functions, ECS containers, and EC2 instances. Three months later, your CloudWatch bill is higher than your compute costs—and you're not even reading those logs.
CloudWatch Logs is deceptively expensive. The costs seem small (fractions of pennies), but at scale, they compound into one of the largest line items on your AWS bill.
The Math That Hurts
CloudWatch Pricing Breakdown
Real-World Example
The Compounding Problem
Without Retention Policies, Costs Compound
| Time | Logs Stored | Storage Cost | + Ingestion | Total Monthly |
|---|---|---|---|---|
| Month 1 | 30GB | $0.90 | $15.00 | $15.90 |
| Month 6 | 180GB | $5.40 | $15.00 | $20.40 |
| Month 12 | 365GB | $10.95 | $15.00 | $25.95 |
| Month 24 | 730GB | $21.90 | $15.00 | $36.90 |
| Month 36 | 1,095GB | $32.85 | $15.00 | $47.85 |
5 Strategies to Cut CloudWatch Costs
Set Retention Policies on All Log Groups
This is the single most impactful change. Most logs are only useful for debugging recent issues.
Recommended Retention
Set via AWS CLI
--log-group-name /aws/lambda/my-function \
--retention-in-days 14
Filter Before Ingestion
Not all logs need to go to CloudWatch. Filter out noise at the source to reduce ingestion costs.
Don't Log
- • Health check responses
- • Successful 200s at INFO level
- • Debug statements in prod
- • Redundant correlation IDs
Log Selectively
- • Errors and warnings
- • Request summaries
- • Key business events
- • Performance outliers
Always Log
- • Authentication events
- • Authorization failures
- • System errors
- • Audit trail events
Lambda Example: Change Log Level
LOG_LEVEL=WARN # Only log warnings and errors
# Or configure in code
logging.getLogger().setLevel(logging.WARNING)
Export Old Logs to S3
For long-term retention, S3 is 10x cheaper than CloudWatch storage.
Cost Comparison
Export Strategy
Use CloudWatch Log Classes
AWS introduced Infrequent Access log class—50% cheaper ingestion for logs you rarely query.
Standard Class
Infrequent Access Class
Create Infrequent Access log group:
--log-group-name /aws/lambda/my-archive-logs \
--log-group-class INFREQUENT_ACCESS
Consolidate Log Groups
Having thousands of small log groups increases management overhead and can lead to unmanaged retention policies.
Before: Log Group Sprawl
After: Organized Hierarchy
Common CloudWatch Cost Culprits
Lambda Functions
- ! Default: Log every invocation at INFO level
- ! Nested JSON objects bloat log size
- ! No default retention policy
- ✓ Fix: Set LOG_LEVEL=WARN and 7-day retention
ECS/Fargate
- ! Container stdout/stderr goes to CloudWatch
- ! Multi-line stack traces multiply log size
- ! Health check logs are noisy
- ✓ Fix: Configure awslogs-datetime-format
API Gateway
- ! Execution logs include full request/response
- ! Access logs for every request
- ! High-traffic APIs = high log volume
- ✓ Fix: Disable execution logs in prod, sample access logs
VPC Flow Logs
- ! Log every network packet metadata
- ! Busy VPCs generate GB/hour
- ! Often enabled and forgotten
- ✓ Fix: Send to S3 instead of CloudWatch
Quick CloudWatch Audit
Run these commands to assess your CloudWatch costs:
1. Find log groups without retention policies:
2. Find largest log groups by storage:
3. Find log groups with most ingestion (last 24h):
--dimensions Name=LogGroupName,Value=YOUR_LOG_GROUP \
--start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
--end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
--period 86400 --statistics Sum
4. Set 14-day retention on all log groups at once:
aws logs put-retention-policy --log-group-name "$lg" --retention-in-days 14
done
See How Much CloudWatch Is Costing You
Upload your AWS Cost Explorer CSV to see a detailed breakdown of your CloudWatch costs and other optimization opportunities.
Analyze My CloudWatch Costs FreeNo credit card required • Instant breakdown • 100% free
The Bottom Line
CloudWatch Logs is a useful service, but its default settings are expensive. The key is to be intentional: decide what you actually need to log, how long you need to keep it, and where the cheapest place to store it is.