Service guide
How to reduce AWS CloudWatch costs
CloudWatch is the utility bill of AWS — nobody chose it, everything feeds it, and it grows with every service you run. Its two defaults do the damage: logs keep forever, and ingestion costs 17x storage, so verbosity is expensive at write time.
The free scan lists every log group with no retention policy, its stored bytes and ingestion rate — the 2023 debug log shows up in seconds.
Run the free scanWhere CloudWatch money leaks
- →Never-expiring log groups. The default retention is forever. Every Lambda, container and application log group accumulates until someone sets a policy — which is free, takes one API call per group, and deletes the backlog within ~72 hours.
- →Ingestion, not storage. $0.50/GB in versus $0.03/GB-month stored. A service logging 5 GB/day costs ~$75/month at the door before storage. DEBUG levels in production, request-body logging and unread access logs are the usual suspects — the fix is logging less, not retaining less.
- →VPC Flow Logs on everything. Enabled account-wide during a security review, capturing ALL traffic, read never. Frequently the single largest ingester in the account. Scope to rejected traffic or specific VPCs, or ship to S3 (~10x cheaper per GB ingested).
- →Custom metrics at $0.30 each. Per metric, per month — and high-cardinality dimensions (per-customer, per-endpoint) multiply metrics silently into thousands. A metrics audit usually finds most custom metrics feed no alarm and no dashboard.
- →Dashboards and alarms debris. Dashboards at $3/month beyond the first three; alarms at $0.10 — individually trivial, collectively a standing charge for observability nobody looks at. Deleting the unused ones is pure hygiene.
Put numbers on it
Frequently asked questions
What retention should we set on log groups?
A workable default: 30 days for application logs, 90 for anything audit-adjacent, 7–14 for access and debug logs. Anything with a compliance requirement beyond that belongs exported to S3 Glacier at roughly a tenth of CloudWatch storage cost. Setting retention is reversible and free — start conservative and tighten.
Will reducing logging hurt our ability to debug?
Cutting noise usually improves it. The expensive logs are the ones nobody reads: health checks, full request bodies, DEBUG chatter. Structured logs at INFO with sampled DEBUG give you better signal per gigabyte — and the ingestion line stops being a top-ten bill item.
£499 fixed. Free scan first. 20%+ found or it’s free.
The scan is read-only — a role you create and delete, no keys shared — and shows your estimated monthly saving before anyone talks about money.