CloudWatch Logs cost: retention, ingestion and Infrequent Access
Short answer: the bill is mostly ingestion. Retention policies are worth setting everywhere, but they trim the small line; the large saving comes from logging less.
What it costs (us-east-1 list prices, illustrative)
Standard ingestion: $0.50 per GB, once, when the data arrives.
Infrequent Access ingestion: $0.25 per GB, with fewer features, chosen at group creation.
Storage: $0.03 per GB-month of archived data, for as long as the retention allows.
Where the money is
Chatty groups: access logs, debug-level application logs and Kubernetes container logs. One group at 2,400 GB a month is $1,200 a month before any storage.
Never-expire groups: a group created with no retention keeps everything forever, so storage grows every month.
Dead groups: a retired Lambda or service whose group still holds hundreds of GB.
Measure and fix
List groups: aws logs describe-log-groups --query 'logGroups[].[logGroupName,storedBytes,retentionInDays,creationTime]' --output text. No retentionInDays means never expires.
Ingested GB per group: the IncomingBytes metric (namespace AWS/Logs) summed over 30 days, divided by 1e9.
Paste rows into the advisor or run node cli.mjs analyze groups.csv. It prints a put-retention-policy command per group worth changing.
Export anything you must keep to S3 first. A retention policy deletes older events, and that cannot be undone.
Questions
Why is my CloudWatch Logs bill so high?
Usually ingestion. Standard class ingestion is $0.50 per GB, billed once when data arrives, while archived storage is $0.03 per GB-month. A group ingesting 2,400 GB a month costs about $1,200 in ingestion and under $30 a month to keep a month of it.
Does shortening retention cut the bill?
Only the storage line, which is small unless a group has never expired for years. Set a retention policy on every group, but the large saving is almost always logging less: lower log levels, no health-check lines, no request or response bodies.
What is the Infrequent Access log class?
A class priced at $0.25 per GB ingested, half of Standard. It lacks metric filters, subscription filters, Live Tail and export, and the class can only be chosen when the log group is created.