Set CloudWatch Log Retention for All Log Groups (SDK v3)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListLogGroups",
      "Effect": "Allow",
      "Action": "logs:DescribeLogGroups",
      "Resource": "*"
    },
    {
      "Sid": "SetRetention",
      "Effect": "Allow",
      "Action": "logs:PutRetentionPolicy",
      "Resource": "arn:aws:logs:*:123456789012:log-group:*"
    }
  ]
}

// set-log-retention.ts
// Finds CloudWatch Logs log groups with no retention ("Never expire") in one region and,
// with --apply, sets a retention period on them. Dry run by default.
// Usage: npx tsx set-log-retention.ts [--days 30] [--prefix /aws/lambda/] [--apply]
import {
  CloudWatchLogsClient,
  PutRetentionPolicyCommand,
  paginateDescribeLogGroups,
  type LogGroup,
} from "@aws-sdk/client-cloudwatch-logs";

// The only values PutRetentionPolicy accepts.
const ALLOWED = [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653];
// USD per GB-month of stored log data, us-east-1, as of September 2026. Other regions differ.
const STORAGE_PER_GB_MONTH = 0.03;

function arg(name: string): string | undefined {
  const i = process.argv.indexOf(name);
  return i === -1 ? undefined : process.argv[i + 1];
}

const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));

async function main(): Promise<void> {
  const days = Number(arg("--days") ?? 30);
  if (!ALLOWED.includes(days)) {
    throw new Error(`--days must be one of: ${ALLOWED.join(", ")}`);
  }
  const prefix = arg("--prefix");
  const apply = process.argv.includes("--apply");
  const logs = new CloudWatchLogsClient({}); // region from AWS_REGION or your profile

  const neverExpire: LogGroup[] = [];
  let total = 0;
  for await (const page of paginateDescribeLogGroups(
    { client: logs },
    prefix ? { logGroupNamePrefix: prefix } : {},
  )) {
    for (const g of page.logGroups ?? []) {
      total++;
      // No retentionInDays means the group keeps events forever.
      if (g.retentionInDays === undefined && g.logGroupClass !== "DELIVERY") neverExpire.push(g);
    }
  }
  if (neverExpire.length === 0) {
    console.log(`All ${total} log groups already have a retention period.`);
    return;
  }

  neverExpire.sort((a, b) => (b.storedBytes ?? 0) - (a.storedBytes ?? 0));
  const gb = (g: LogGroup) => (g.storedBytes ?? 0) / 1024 ** 3;
  console.table(
    neverExpire.map((g) => ({
      "Log group": g.logGroupName,
      Class: g.logGroupClass ?? "STANDARD",
      Created: g.creationTime ? new Date(g.creationTime).toISOString().slice(0, 10) : "",
      "Stored GB": gb(g).toFixed(2),
      "Storage $/mo": (gb(g) * STORAGE_PER_GB_MONTH).toFixed(2),
    })),
  );
  const totalGb = neverExpire.reduce((s, g) => s + gb(g), 0);
  console.log(
    `${neverExpire.length} of ${total} log groups never expire: ${totalGb.toFixed(1)} GB, ` +
      `about $${(totalGb * STORAGE_PER_GB_MONTH).toFixed(2)}/month in storage and growing.`,
  );

  if (!apply) {
    console.log(`Dry run. Re-run with --apply to set ${days}-day retention on these ${neverExpire.length} groups.`);
    return;
  }

  let done = 0;
  for (const g of neverExpire) {
    const name = g.logGroupName ?? "";
    try {
      await logs.send(new PutRetentionPolicyCommand({ logGroupName: name, retentionInDays: days }));
      done++;
      console.log(`${name}: retention set to ${days} days`);
    } catch (err) {
      console.error(`${name}: ${(err as Error).name}: ${(err as Error).message}`);
    }
    await sleep(250); // stay well under the API rate limit on accounts with thousands of groups
  }
  console.log(`Done. ${done} of ${neverExpire.length} log groups updated. Older events are removed within about 72 hours.`);
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-cloudwatch-logs
npm install --save-dev tsx typescript

# 1. Dry run: which groups never expire, and what do they cost?
AWS_PROFILE=readonly AWS_REGION=us-east-1 npx tsx set-log-retention.ts

# 2. Lambda log groups: 30 days
AWS_PROFILE=ops AWS_REGION=us-east-1 npx tsx set-log-retention.ts --prefix /aws/lambda/ --days 30 --apply

# 3. Everything else that still never expires: 90 days
AWS_PROFILE=ops AWS_REGION=us-east-1 npx tsx set-log-retention.ts --days 90 --apply

┌─────────┬──────────────────────────────────┬────────────┬──────────────┬───────────┬──────────────┐
│ (index) │ Log group                        │ Class      │ Created      │ Stored GB │ Storage $/mo │
├─────────┼──────────────────────────────────┼────────────┼──────────────┼───────────┼──────────────┤
│ 0       │ '/aws/vpc/flow-logs-prod'        │ 'STANDARD' │ '2022-03-14' │ '1843.20' │ '55.30'      │
│ 1       │ '/aws/lambda/orders-api'         │ 'STANDARD' │ '2021-06-02' │ '412.75'  │ '12.38'      │
│ 2       │ '/ecs/checkout-service'          │ 'STANDARD' │ '2023-01-19' │ '96.10'   │ '2.88'       │
│ 3       │ '/aws/lambda/nightly-report'     │ 'STANDARD' │ '2024-08-30' │ '3.42'    │ '0.10'       │
│ 4       │ '/aws/lambda/test-hello-world'   │ 'STANDARD' │ '2025-02-11' │ '0.00'    │ '0.00'       │
└─────────┴──────────────────────────────────┴────────────┴──────────────┴───────────┴──────────────┘
5 of 38 log groups never expire: 2355.5 GB, about $70.66/month in storage and growing.
Dry run. Re-run with --apply to set 30-day retention on these 5 groups.