Question 235577 in Amazon Web Sevices Question posted in
The official Amazon Web Services documentation can be found here.

Amazon web services – Can we prevent deleting clodwatch log groups?

In my production account I have multiple cloudwatch log groups which should not be deleted under any circumstances. I could not find any strait forward way to do this. Appreciate your support if there a way I can do this.

Tags:

2

Answers


  1. 0

    By setting up a retention policy that ensures logs are never deleted, they can be protected via a retention policy.Further more details checkout this link Retention Policy Cloud Watch

    Login or Signup to reply.
  2. 0

    You have three options.

    First, you can define granular access to those log groups, and simply not grant the DeleteLogGroup permission. This is, IMO, the best approach.

    Second, you can create a permissions boundary, which is attached to all of the IAM users/roles that can access the log groups in question, and denies the DeleteLogGroup permission. The drawback to permissions policies is that you have to apply them everywhere.

    Third, if you have set up an organization, you can create a service control policy that explicitly denies DeleteLogGroup for those log groups. Apply this to the account(s), and nobody, not even the root user, will be able to delete the group(s).

    If you go with the third option, be sure to read through the documentation on AWS Organizations. One thing that AWS recommends is that the organization root account not be used for any workloads, so you should create a new account to serve as the organization root and invite your current account.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search