Which compliance frameworks require ensure cloudwatch log groups have retention configured?

This security check is required by the following compliance frameworks: SOC 2, PCI-DSS, HIPAA, NIST 800-53.

MEDIUM

Ensure CloudWatch log groups have retention configured

CloudWatch log groups should have retention periods configured to manage costs and compliance.

Security Impact

Without retention policies, logs grow indefinitely, increasing costs and potentially retaining data beyond required periods.

How to Remediate

Configure retention periods on log groups based on compliance requirements (30-365 days typical).

Affected Resources

AWS::Logs::LogGroup

Compliance Frameworks

SOC 2PCI-DSSHIPAANIST 800-53

How TigerGate Helps

TigerGate continuously monitors your AWS environment to detect and alert on this misconfiguration. Here's what our platform does for this specific check:

Continuous Scanning
Automatically scans all Amazon CloudWatch resources across your AWS accounts every hour
Instant Alerts
Get notified via Slack, email, or webhooks when this misconfiguration is detected
One-Click Remediation
Fix this issue directly from the TigerGate dashboard with our guided remediation
Compliance Evidence
Automatically collect audit evidence for SOC 2, PCI-DSS, HIPAA compliance
Drift Detection
Get alerted if this configuration drifts back to an insecure state after remediation