Check if CloudWatch Log Groups have a retention policy of specific days.
cloudwatch_log_group_retention_policy_specific_days_enabled
Check if CloudWatch Log Groups have a retention policy of specific days.
Risk
If log groups have a low retention policy of less than specific days, crucial logs and data can be lost.
Run this check with Prowler CLI
prowler aws --checks cloudwatch_log_group_retention_policy_specific_days_enabled
ARN template
arn:partition:cloudwatch:region:account-id:certificate/resource-id
Remediation
aws logs put-retention-policy --log-group-name <LOG_GROUP_NAME> --retention-in-days <DAYS>
https://docs.prowler.com/checks/aws/logging-policies/logging_13#cloudformation
https://docs.prowler.com/checks/aws/logging-policies/logging_13#terraform
https://docs.prowler.com/checks/aws/logging-policies/logging_13
Add Log Retention policy of specific days to log groups. This will persist logs and traces for a long time.
Source Code
Resource Type
AwsLogsLogGroup