CloudWatch log group retained for more than a year (audit-tier retention)

What it checks

CloudWatch log group retained for more than a year (audit-tier retention)

Where it applies

Terraform: aws_cloudwatch_log_group

CloudFormation: AWS::Logs::LogGroup

How to fix it

1. Confirm legal, incident-response and workload retention requirements. Export required history to durable archival storage and verify the export before changing this group's retention.
2. Choose a workload-specific retention period manually. Reducing retention marks older historical logs for deletion; do not replace an authored audit requirement with a default thirty-day period.

Frameworks

• AWS Well-Architected COST.4

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules