One rule for many log groups
Amazon CloudWatch Logs introduced account-level retention policies on November 9. Teams can apply a policy to all log groups in an account and Region, or select groups whose names share a prefix. Each account can have up to 20 policies per Region.
AWS lists the feature at no additional cost in commercial Regions except Middle East (Bahrain) and Middle East (UAE). That statement concerns the policy feature, rather than a promise that all CloudWatch usage is free.
The longest-policy rule has an important boundary
When several account-level policies match, the longest retention period wins; NEVER_EXPIRE counts as the longest. However, an account-level rule overrides the log group’s own setting, even when that local setting was longer.
AWS gives the example of a group previously retaining ten years of logs: applying a 90-day account policy makes older events subject to deletion. A longer existing group setting therefore does not protect its history from a shorter account-level rule.
Preview scope and timing before applying it
Policies require a minimum of 30 days or indefinite retention. RETROACTIVE covers matching existing groups; NEW_ONLY covers groups created after the policy. A new or updated policy takes effect after 24 hours.
The documented dryRun option previews how many groups would get longer, shorter or unchanged retention without saving the policy. It needs the same permissions as the real operation. Administrators can use that preview and inspect the selected prefixes before changing retention; expired events are typically deleted within 72 hours, sometimes longer.
