CloudWatch Logs charges for ingestion, storage, and — if you're using Logs Insights or metric filters — for scanning. Ingestion is the one that grows quietly, because every log group AWS creates for you defaults to Never Expire retention, and almost nobody goes back and changes it.
The default nobody set on purpose
Never Expire is a reasonable default for AWS to ship — deleting logs automatically would be a worse failure mode than storing them too long. But it means every Lambda function, every ECS task, every API Gateway stage that's ever been deployed is a log group accumulating storage cost indefinitely unless someone explicitly set a retention period.
Same ingestion rate, two retention settings — one curve keeps climbing forever, the other flattens once the oldest events expire.
The ingestion charge is the bigger of the two in most accounts, and it's a one-time cost per byte ingested regardless of retention — so retention policy doesn't reduce what you already paid to bring the data in. What it controls is how much of that history keeps costing storage indefinitely, and it's a lever you can pull retroactively on every log group at once.
Where the volume actually comes from
- Debug-level logging left on in production — turned up during an incident, never turned back down.
- Log group sprawl — every Lambda alias, every CI run, every short-lived environment leaves its own log group behind after the resource is gone.
- Structured logging with large payloads — full request/response bodies logged on every invocation instead of on error, multiplying volume by traffic.
What to check first
- Cost Explorer filtered to the CloudWatch Logs usage type shows the ingestion trend — if it's climbing steadily with no corresponding traffic growth, that's log volume creeping, not demand.
- A one-time sweep to set explicit retention (30, 90, whatever your compliance posture requires) on every log group closes the "forgot to set it" gap without touching what's already been ingested.
- Subscription filters or export-to-S3 with Glacier lifecycle rules are worth it only if there's a real compliance requirement to keep logs long-term — S3 storage is meaningfully cheaper per GB than CloudWatch Logs storage for anything you're not actively querying.