> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-338.md).

# AWS CloudWatch log groups retention set to less than 365 days misconfiguration detected in code

## Rule Details

|                        |                                      |
| ---------------------- | ------------------------------------ |
| Cortex AppSec Rule ID  | APPSEC\_AWS\_338                     |
| Category - Subcategory | Logging - Retention                  |
| Provider               | AWS                                  |
| Severity               | LOW                                  |
| Framework              | Terraform, Terraform Plan            |
| Mapped CSPM/KSPM Rule  | c95b15e2-3bad-4c39-a04c-014fb6ef7890 |

## Impact

This rule is checking to ensure that CloudWatch log groups in AWS are set to retain logs for at least one year. Logging is a crucial aspect of maintaining a secure and reliable environment in systems. Logs can provide valuable insights into system operations, errors, access, usage patterns and potential security incidents. If a log group in CloudWatch is not configured to retain logs for a certain period of time, important data could be lost. In some cases, regulations and standards may also require logs to be retained for specific periods. Failing to retain logs for at least one year could hinder system troubleshooting, vulnerability detection, auditing, and compliance verification.

## How to Fix

*Resource:* aws\_cloudwatch\_log\_group

* *Arguments:* retention\_in\_days

To fix the issue, you should add a retention\_in\_days attribute to your aws\_cloudwatch\_log\_group resource and set its value to at least 365 to retain logs for one year as follows:

## This code is secure because it ensures CloudWatch Log Groups retain logs for at least one year, which is essential for audit and incident response purposes. AWS CloudWatch logs are important for troubleshooting and understanding the interactions between different internal services, and retaining these logs for an extended period is a good practice from a security perspective. \[source,go]

resource "aws\_cloudwatch\_log\_group" "example" { name = "example"

## retention\_in\_days = 365 }


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec-aws-338.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.