AWSCostAWS cost · CloudWatch logs
Why your CloudWatch logs bill is so high - and how to cut it
Logging feels free. You point your application at CloudWatch, it works, and you move on. The meter is running the whole time. CloudWatch charges $0.50 for every gigabyte of logs it takes in, before storage or a single query. On one cluster I looked at, log ingestion alone was costing about $700/month - just to get the logs in. Nobody chose to spend that. The log level was left on and the volume grew.
CloudWatch charges $0.50/GB just to ingest logs, before storage - and it can reach hundreds of dollars a month on a single busy cluster. Switch non-critical log groups to the Infrequent Access class ($0.25/GB, half price), set a retention limit so logs do not live forever, and replace log-based metrics with free metric filters. Most of the bill is volume you never read.
What am I actually paying for in CloudWatch Logs?
Three separate charges: ingestion (the big one), storage at $0.03/GB-month, and Logs Insights queries billed on data scanned. Since the default retention is forever, storage keeps climbing on its own. The first lever is the ingestion rate, and the log class you choose sets it:
| Log class | Ingestion | Note |
|---|---|---|
| Standard | $0.50/GB | full features, real-time monitoring |
| Infrequent Access | $0.25/GB | half price, still supports Logs Insights queries |
Why is so much log volume being ingested?
Almost always because verbose logging was left on. DEBUG or INFO level in production generates terabytes of lines that are rarely read, and every gigabyte pays the ingestion rate. If your workload runs in a private subnet, shipping those logs out can also incur NAT gateway processing charges on top of the CloudWatch bill - the same volume charged twice.
How do I reduce CloudWatch log costs?
Send less and send it cheaper. Turn production logging back down to the level you actually read. Switch non-critical log groups to the Infrequent Access class and halve the ingestion rate. Set a 30 or 60-day retention policy so storage stops growing forever. Replace any log-based counters with free metric filters - they sidestep the custom-metric charges entirely. And route high-volume service logs - VPC flow logs, CloudTrail - straight to S3, which skips the CloudWatch ingestion charge completely.
First find the log groups that never expire, then cap one:
# log groups with no retention set - they keep data forever
aws logs describe-log-groups \
--query 'logGroups[?retentionInDays==`null`].logGroupName'
# cap one at 30 days
aws logs put-retention-policy \
--log-group-name /my/log/group --retention-in-days 30Should I move logs out of CloudWatch?
Move the logs you rarely touch, keep the ones you alert on. CloudWatch earns its price for the logs you query and monitor in near real time. For everything else - audit trails, flow logs, archives - S3 is far cheaper and still queryable when you need it. The goal is not to stop logging; it is to stop paying real-time monitoring prices for data nobody looks at.
Want to know how much of your CloudWatch bill is avoidable? Connect your account read-only and see what it is wasting, in real dollars.
The role can only read - Get, Describe, List, nothing else. Read the exact permissions before you deploy it, and delete the stack whenever you want.
Frequently asked questions
Why is my CloudWatch bill so high?+
CloudWatch charges $0.50/GB just to ingest logs, before any storage or queries. Verbose application logging - DEBUG or INFO level left on in production - can push terabytes into CloudWatch, and the ingestion charge is where the bill really grows.
How much does CloudWatch log ingestion cost?+
Standard log ingestion is $0.50/GB. Storage is a separate $0.03/GB-month, and Logs Insights queries are billed on data scanned. On a busy system, ingestion alone can reach hundreds of dollars a month per cluster.
What is the CloudWatch Infrequent Access log class?+
A cheaper log class at $0.25/GB ingestion - half the Standard rate. As of early 2026 it also supports Logs Insights queries, which makes it a sensible default for application logs that do not need real-time monitoring.
How do I reduce CloudWatch log ingestion?+
Send less, and send it cheaper. Turn off DEBUG/INFO logging in production, switch non-critical log groups to the Infrequent Access class, set a retention limit, and route high-volume service logs (VPC flow logs, CloudTrail) straight to S3 instead of CloudWatch.
Do CloudWatch logs have a retention period by default?+
No. By default logs are kept forever, which is one of the most common cost traps. Set a retention policy - 30 or 60 days on non-critical groups - so storage does not grow without limit.
Are metric filters cheaper than custom metrics?+
Yes. A metric filter that extracts a value from your logs is free, while publishing the same data as a custom metric is billed per metric. If you only need a count or a value out of a log stream, a metric filter does it without adding metric charges.
Should I send logs to S3 instead of CloudWatch?+
For high-volume, rarely-queried logs, yes. CloudTrail and VPC flow logs can be delivered directly to S3, which avoids the CloudWatch ingestion charge entirely. Keep in CloudWatch only the logs you actually alert or query on in near real time.
Related cost breakdowns
CloudWatch metrics and alarms cost more than you think
Custom metrics cost $0.30 each and alarms $0.10 each past the free 10 - hundreds created and forgotten add up fast. Here is how to find the ones nobody looks at and cut them.
Why EKS is expensive: the $73/month control plane
Every EKS cluster bills $0.10/hour - about $73/month - for the control plane before a single node runs, and $0.60/hour once it falls out of standard support. Idle and forgotten clusters are pure waste.
ECR storage costs $0.10/GB - and CI builds pile it up
ECR stores container images at $0.10/GB-month, and every CI build pushes layers that never expire on their own. Without a lifecycle policy the bill climbs forever - here is how to cap it.