AWS Config Rule Bug - Build Custom Replacement?

[ditahkk]

Problem 🐛

AWS's CW_LOGGROUP_RETENTION_PERIOD_CHECK rule is broken. It marks log groups with infinite retention (retentionInDays: null) as COMPLIANT.

Result: 99% of real log groups pass compliance while having no retention policy.

# 25 log groups with infinite retention
❯ aws logs describe-log-groups --query "logGroups[?retentionInDays == null].logGroupName"
00-zsoftly-tests-fsg6e  01-zsoftly-tests-u6683  02-zsoftly-tests-voos4...

# AWS Config says: ALL COMPLIANT ✅ 
# Reality: ALL NON-COMPLIANT ❌

Impact 💰

• logguardian can't detect/fix the main compliance issue it was built for
• Cost reality: CloudWatch Logs storage in ca-central-1 costs $0.033/GB compressed/month ($0.22/GB uncompressed/month)
• Free tier: Only covers first 5GB total across all log groups
• The problem: null retention = logs stored forever vs. setting retention = automatic deletion for cost control

Example cost impact (realistic scenario):

• 100 log groups, each generating 500MB/month
• With null retention: After 12 months = 100 × 6GB × $0.22 = $132/month (and growing)
• With 30-day retention: 100 × 0.5GB × $0.22 = $11/month (stable)
• Cost savings: 92% reduction by setting proper retention policies

Proposed Solution 🛠️

Build custom Config rule in Go that properly flags null retention as NON_COMPLIANT.

Quick implementation:

if retention == nil {
    return "NON_COMPLIANT", "No retention policy set"
}

Questions 🤔

1. Worth the effort vs waiting for AWS to fix their rule?
2. Anyone else hit this issue?
3. Should we open source it for the community?

👍 Build custom rule
👎 Wait for AWS
🤔 Need more info

References 📚

• AWS CloudWatch Pricing
• AWS Config Rule Documentation
• CloudWatch Logs Retention Documentation

---

** See Screenshot below**: AWS Config rule documentation showing:

"If the retention setting is 'Never expire' for a log group, the rule is marked as COMPLIANT."

This single line makes the entire Config rule useless for real-world compliance monitoring. 🤦‍♂️

This affects every AWS account using default log groups. Thoughts?