How do I restore or prevent deletion of logs or log groups in CloudWatch?

Short description

By default, Amazon CloudWatch Logs stores logs indefinitely and never expire. However, if you modify the retention period settings, then CloudWatch Logs stores the data only until the retention period. After the retention period, CloudWatch Logs deletes the data from the log group. You can modify the retention settings and choose a retention period between one day and 10 years, or retain logs indefinitely.

Note: You can't recover logs that you deleted or expired through the retention policy. AWS can't recover the logs either.

Resolution

To control who can delete log groups and export logs for long-term storage, complete the following procedures.

Modify IAM permissions for the CloudWatch log groups

Complete the following steps:

1. Open the AWS Identity and Access Management (IAM) console.
2. In the navigation pane, choose Users or Roles.
3. From the list, select the IAM user or role whose policy you want to modify.
4. Choose the Permissions tab, and then choose Add permissions.
5. Choose Create inline policy, and then enter the following policy statement to set the DeleteLogGroup, DeleteLogStream, and PutRetentionPolicy actions to Deny:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "VisualEditor0",
         "Effect": "Deny",
         "Action": [
           "logs:DeleteLogGroup",
           "logs:DeleteLogStream",
           "logs:PutRetentionPolicy"
         ],
         "Resource": "*"
       }
     ]
   }

   Note: After you apply this IAM policy, IAM users can't delete log data or change retention settings across all log groups. For more information, see Using identity-based policies (IAM policies) for CloudWatch Logs and CloudWatch Logs permissions reference.

(Optional) Turn on deletion protection

By default, deletion protection is off. Turn on deletion protection to prevent accidental deletion of log groups.

Export CloudWatch logs to an Amazon S3 bucket

Export CloudWatch log data to an Amazon Simple Storage Service (Amazon S3) bucket for long-term storage, backup, and custom analysis of log data.