Ingestion, not storage
Why is CloudWatch so expensive?
CloudWatch surprises people because the expensive part is not the part that looks expensive. Storing logs is cheap. Getting them in is not, and nothing ever deletes them.
CloudWatch is expensive mainly because of log ingestion at $0.50 per GB, custom metrics at $0.30 each per month, and a default retention setting of "never expire" on every log group AWS creates. Storage itself is only $0.03 per GB-month. A service writing 5 GB of logs a day costs about $75 a month to ingest before a single byte is stored, and the storage then accumulates forever.
CloudWatch price list, and which line usually dominates
| Charge | Rate | Notes |
|---|---|---|
| Logs ingestion | $0.50 per GB | Nearly always the largest line |
| Logs storage | $0.03 per GB-month | Small per GB, but never stops growing |
| Custom metrics | $0.30 per metric per month | Every unique name plus dimension combination |
| Dashboards | $3 per dashboard per month | First three are free |
| Logs Insights queries | $0.005 per GB scanned | Scans the whole retention window unless you narrow it |
| Alarms | $0.10 per standard alarm per month | High-resolution alarms cost more |
us-east-1 list prices. Other major regions are within a few percent.
The four causes, in the order we usually find them
- →VPC Flow Logs capturing everything. Enabled once for a security review, set to ALL traffic on every interface, read by nobody since. In accounts with real traffic this is regularly the single biggest log ingester, at $0.50 per GB.
- →Debug logging left on in production. Someone raised the log level to debug during an incident, the incident closed, and the level stayed. Ingestion cost scales linearly with verbosity and nothing warns you.
- →Never-expire retention. Every new log group defaults to keeping data forever. A group that has been ingesting steadily since 2023 is still paying storage on every line from 2023. Setting retention is free, takes one API call per group, and deletes the excess within about 72 hours.
- →Custom metric explosion. At $0.30 per metric per month, a metric published per customer, per container or per request ID becomes an expensive way to count things. One team emitting a metric per pod ID across an autoscaling group can generate thousands of unique metrics a month.
What to change, in order
Set retention on every log group. Thirty days for application logs, ninety for anything close to an audit trail, one to fourteen for debug and access logs. If compliance needs years, export to S3, where Glacier Instant Retrieval is around a tenth of the CloudWatch storage price.
Then turn down what you send. Drop the log level where it is noise, sample high-volume access logs rather than keeping every line, and stop logging health checks. A load balancer health-checking every five seconds writes roughly 500,000 lines a month per target, all of it noise, all of it billed at ingest.
Then look at flow logs. Filter to REJECT only, or sample, or turn them off outside the subnets that need them. Full capture on every interface is a setting almost nobody actually needs.
Put numbers on it
Frequently asked questions
Does setting retention delete my logs immediately?
Data past the new window disappears within about 72 hours and the storage charge stops with it. The change is free, needs no restart, and does not affect ingestion. It is one of the safest cost changes available on AWS, which is why it is usually the first thing we recommend.
Is CloudWatch cheaper than a third-party logging platform?
Usually yes on price per GB, and usually worse on query experience. The comparison people should actually make is between CloudWatch with retention set and sensible log levels, and a third-party tool ingesting the same volume. Most of the time the problem is the volume rather than the destination.
How do I find which log group is costing the most?
The CloudWatch console lists log groups with stored bytes, which is a good proxy but only tells you about storage. For ingestion, Cost Explorer filtered to CloudWatch and grouped by usage type separates DataProcessing-Bytes from TimedStorage-ByteHrs. The gap between the two is what tells you whether retention or verbosity is your problem.
What about CloudWatch Logs Insights queries?
They bill $0.005 per GB scanned, which is trivial until someone runs an unbounded query across a year of retained logs. Narrowing the time range on a query is both faster and cheaper, and long retention makes accidental expensive queries possible in the first place.
Keep reading
Prices checked against AWS list rates on 2 August 2026. AWS changes prices; treat every figure here as a close approximation rather than a quote.
£499 fixed. Free scan first. 20%+ found or it’s free.
The scan is read-only — a role you create and delete, no keys shared — and shows your estimated monthly saving before anyone talks about money.