Free calculator
CloudWatch Logs cost calculator
Every new log group defaults to keeping every line forever. That is $0.50 per GB to ingest, $0.03 per GB-month to store, and no expiry, so the bill only goes one way. Setting a retention policy costs nothing and stops it.
CloudWatch → Log groups → IncomingBytes, summed.
Everything accumulated — 'Never expire' groups keep it all.
What a 30–90 day retention policy would leave.
Ingestion
$25.00/month
$300.00/year · ≈ £20/month
Storage
$24.00/month
$288.00/year · ≈ £19/month · total $49.00/mo
Retention saving
$21.00/month
$252.00/year · ≈ £16/month
$0.50/GB ingested + $0.03/GB-month stored. Note the ratio: ingesting a gigabyte costs ~17x storing it for a month — if the ingestion card dwarfs the storage card, the real fix is logging less, not retention.
The free scan lists every log group with no retention policy, its stored bytes and its ingestion rate — the never-expiring debug log from 2023 shows up in seconds.
Estimate the whole billThe usual suspects
- →Never-expire log groups. The default. Every Lambda, every ECS task, every application that ever logged creates a group that keeps everything until the account is closed.
- →Debug logging left on in production. A debugging session two years ago set the level to DEBUG. The ticket closed and the level stayed. At $0.50 per GB ingested, that is an expensive way to be thorough.
- →VPC Flow Logs capturing everything. Enabled once for a security review, capturing ALL traffic on every interface, read never. Frequently the biggest single ingester in the account.
- →Health checks and access logs. A load balancer health-checking every 5 seconds writes around 500,000 log lines a month per target. All noise, all billed.
- →Compliance archives in the wrong tier. Keeping years of logs for compliance is reasonable. Keeping them in CloudWatch at $0.03 per GB-month rather than S3 Glacier at about $0.004 means paying roughly seven times over for the privilege.
Frequently asked questions
Why is CloudWatch Logs so expensive?
Ingestion is the expensive part rather than storage: $0.50 per GB ingested against $0.03 per GB-month stored. A service logging 5 GB a day costs about $75 a month before anything is kept. Verbose logging levels left on in production are the usual cause.
What does "Never expire" mean for my bill?
It is the default retention on every new log group, so nothing is ever deleted and storage grows in a straight line forever. A log group that has been ingesting steadily since 2023 is still paying for every line it received in 2023. Setting retention costs nothing and takes one API call per group.
What retention period should I set?
A common pattern is 30 days for application logs, 90 days for anything close to an audit trail, and 1 to 14 days for debug and access logs. If compliance needs longer than that, export to S3, where Glacier tiers cost roughly a tenth of CloudWatch storage.
Does setting retention delete logs immediately?
Logs past the new window go within about 72 hours and the storage charge stops with them. The change is free, needs no restart and does not touch ingestion, which makes it one of the safest cost fixes available on AWS.
How do I cut ingestion cost, not just storage?
Drop the log level from DEBUG or INFO wherever it is noise, sample high-volume access logs, and stop logging request bodies and health checks. Then look at VPC Flow Logs. Enabled account-wide with full capture, they are often the largest ingester in the account and nobody reads them.