Lambda function should have an explicitly declared CloudWatch log group

What it checks

Lambda function: no explicit CloudWatch log group is defined.

Where it applies

Terraform: aws_lambda_function

CloudFormation: AWS::Lambda::Function

How to fix it

1. Create an aws_cloudwatch_log_group with name = "/aws/lambda/<function_name>" and retention_in_days = 90 (or as required by policy)

Frameworks

• SOC 2 CC7.2
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules