# Suboptimal Log Class Configuration in CloudWatch

Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/suboptimal-log-class-configuration-in-cloudwatch

[Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) 

# Suboptimal Log Class Configuration in CloudWatch

## Explanation

By default, CloudWatch Log Groups use the Standard log class, which applies higher rates for both ingestion and storage. AWS also offers an Infrequent Access (IA) log class designed for logs that are rarely queried - such as audit trails, debugging output, or compliance records. Many teams assume storage is the dominant cost driver in CloudWatch, but in high-volume environments, ingestion costs can account for the majority of spend. When logs that are infrequently accessed are ingested into the Standard class, it leads to unnecessary costs without impacting observability. The IA log class offers significantly reduced rates for ingestion and storage, making it a better fit for logs used primarily for post-incident review, compliance retention, or ad hoc forensic analysis.

## Relevant Billing Model

CloudWatch Logs are billed based on: \* Ingestion volume per GB \* Storage per GB-month \* Querying via Logs Insights (optional) By default, Log Groups are set to the  Standard  log class. However, AWS offers an  Infrequent Access  (IA) log class with significantly lower ingestion and storage rates. This class is ideal for logs accessed occasionally, such as security audits, application debugging, or forensic analysis. Because the log class must be set at creation, many environments default to Standard even when IA would be more cost-effective.

## Detection

- Identify all log groups currently using the Standard log class

- For each, assess whether logs are actively queried or primarily retained for infrequent access

- Review ingestion volumes relative to query frequency to surface high-ingest, low-access patterns

- Evaluate log retention periods - long-retained logs with low query activity are strong candidates

- Analyze whether ingestion charges account for a significant portion of CloudWatch costs

- Flag logs used for compliance, audit, or post-incident forensics that could be routed to Infrequent Access

## Remediation

- Create new log groups using the  Infrequent Access  class for applicable use cases

- Update application and service configurations to route logs to the new log groups

- Use subscription filters or log routing to separate high-access logs (Standard) from infrequent logs (IA)

- Apply tagging or naming conventions to distinguish log groups by access frequency or retention intent

- Periodically audit log group configurations and adjust routing based on evolving usage patterns

## Relevant Documentation

[https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogsLogClass.html](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogsLogClass.html) 
[https://aws.amazon.com/cloudwatch/pricing/\\#Logs](https://aws.amazon.com/cloudwatch/pricing/#Logs)

[Submit Feedback](https://hub.pointfive.co/inefficiencies/suboptimal-log-class-configuration-in-cloudwatch)

## At a glance

Reference

CER-0224

Cloud provider

AWS

Service

AWS CloudWatch

Category

[Other](https://www.pointfive.co/efficiency-hub/service-category/other)

Inefficiency type

Misconfiguration

## Contributed by

- Kyler Rupe 

### Kyler Rupe

Cloud FinOps Engineer @ Koch

[LinkedIn](https://www.linkedin.com/in/kyler-rupe-8b802a190/)

---
Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.