> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-338.md).

# AWS CloudWatch log groups retention set to less than 365 days misconfiguration detected in code

## Rule Details

|                        |                                      |
| ---------------------- | ------------------------------------ |
| Cortex AppSec Rule ID  | APPSEC\_AWS\_338                     |
| Category - Subcategory | Logging - Retention                  |
| Provider               | AWS                                  |
| Severity               | LOW                                  |
| Framework              | Terraform, Terraform Plan            |
| Mapped CSPM/KSPM Rule  | c95b15e2-3bad-4c39-a04c-014fb6ef7890 |

## Impact

This rule is checking to ensure that CloudWatch log groups in AWS are set to retain logs for at least one year. Logging is a crucial aspect of maintaining a secure and reliable environment in systems. Logs can provide valuable insights into system operations, errors, access, usage patterns and potential security incidents. If a log group in CloudWatch is not configured to retain logs for a certain period of time, important data could be lost. In some cases, regulations and standards may also require logs to be retained for specific periods. Failing to retain logs for at least one year could hinder system troubleshooting, vulnerability detection, auditing, and compliance verification.

## How to Fix

*Resource:* aws\_cloudwatch\_log\_group

* *Arguments:* retention\_in\_days

To fix the issue, you should add a retention\_in\_days attribute to your aws\_cloudwatch\_log\_group resource and set its value to at least 365 to retain logs for one year as follows:

## This code is secure because it ensures CloudWatch Log Groups retain logs for at least one year, which is essential for audit and incident response purposes. AWS CloudWatch logs are important for troubleshooting and understanding the interactions between different internal services, and retaining these logs for an extended period is a good practice from a security perspective. \[source,go]

resource "aws\_cloudwatch\_log\_group" "example" { name = "example"

## retention\_in\_days = 365 }


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-338.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.