CloudWatch log group should have a retention period configured

What it checks

CloudWatch log group: no retention period is set.

Where it applies

Terraform: aws_cloudwatch_log_group

CloudFormation: AWS::Logs::LogGroup

How to fix it

1. Confirm compliance and investigation requirements, choose the retention period for this workload, then export and verify any required historical logs before imposing finite retention. Events older than the new period are marked for deletion; no universal automatic value is safe.

Frameworks

• AWS FSBP CloudWatch.16
• SOC 2 CC7.2
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules