Cloudwatch Loggroup Retention Period Should Be Reviewed
More Info:
This rule checks if an Amazon CloudWatch LogGroup retention period is set to greater than 365 days or else a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.Risk Level
MediumAddress
ConfigurationCompliance Standards
SOC2,HIPAA,GDPR,NISTCSF,PCIDSS,RBI_MD_ITF,RBI_UCBTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of CloudWatch Log Group retention period in AWS, follow these steps using the AWS Management Console:
- Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/) and login to your account.
- Navigate to CloudWatch: Click on the “Services” dropdown at the top of the page, search for “CloudWatch” in the search bar, and click on the CloudWatch service.
- Select Log Groups: In the CloudWatch dashboard, click on “Log groups” in the left-hand menu to view all the log groups in your account.
- Find the Log Group: Locate the log group for which you want to review or update the retention period. You can use the search bar to find the log group quickly.
-
Update Retention Period:
- Click on the log group name to open the log group details.
- In the log group details page, click on the “Edit” button next to the “Retention settings” section.
- Update the retention period as per your requirements. You can choose a value between 1 day to 10 years or select “Never Expire” if you want to retain logs indefinitely.
- Click on the “Save changes” button to apply the new retention period.
- Verify the Changes: Once you have updated the retention period, you can verify the changes by checking the “Retention settings” section in the log group details.
Using CLI
Using CLI
To remediate the CloudWatch Loggroup retention period misconfiguration in AWS using the AWS CLI, follow these steps:Replace By following these steps, you can remediate the CloudWatch Loggroup retention period misconfiguration in AWS using the AWS CLI.
- List all the CloudWatch log groups to identify the ones with retention periods that need to be reviewed:
- Identify the log group for which you want to update the retention period.
- Update the retention period for the identified log group using the following command:
YOUR_LOG_GROUP_NAME with the name of the log group you want to update and YOUR_RETENTION_PERIOD with the desired retention period in days.For example, to set the retention period of a log group named “my-log-group” to 30 days, you would run:- Verify that the retention period has been updated successfully by describing the log group again:
Using Python
Using Python
To remediate the CloudWatch Loggroup retention period misconfiguration in AWS using Python, follow these steps:
- Install the AWS SDK for Python (Boto3) if you haven’t already:
- Use the following Python script to update the retention period for the CloudWatch Loggroup:
-
Replace
'YOUR_LOG_GROUP_NAME'with the name of the CloudWatch Log Group you want to update andYOUR_DESIRED_RETENTION_DAYSwith the desired retention period in days. - Run the Python script to update the retention period for the specified CloudWatch Log Group.