AWS CloudWatch Log groups not configured with definite retention days misconfiguration detected in c

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_66
Category - Subcategory	Logging - Retention
Provider	AWS
Severity	LOW
Framework	CloudFormation, Serverless, Terraform, Terraform Plan

Impact

Enabling CloudWatch retention establishes how long log events are kept in AWS CloudWatch Logs. Retention settings are assigned to CloudWatch log groups and the retention period assigned to a log group is applied to their log streams. Any data older than the current retention setting is deleted automatically. You can change the log retention for each log group at any time. Log data is stored in CloudWatch Logs indefinitely by default, l. This may incur high unexpected costs, especially when combined with other forms of logging. We recommend you configure how long to store log data for in a log group to balance cost with compliance retention requirements.

How to Fix

Resource: aws_cloudwatch_log_group

• Arguments: Properties.RetentionInDays - (Optional) Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653, and 0. If you select 0, the events in the log group are always retained and never expire. [source,go]

---

Resources: logGroup: Type: AWS::Logs::LogGroup Properties: ...

• RetentionInDays: 90

---