Amazon CloudWatch Logs

2025/11/24 - Amazon CloudWatch Logs - 1 new 2 updated api methods

Changes  New CloudWatch Logs feature - LogGroup Deletion Protection, a capability that allows customers to safeguard their critical CloudWatch log groups from accidental or unintended deletion.

PutLogGroupDeletionProtection (new) Link ¶

Enables or disables deletion protection for the specified log group. When enabled on a log group, deletion protection blocks all deletion operations until it is explicitly disabled.

For information about the parameters that are common to all actions, see Common Parameters.

See also: AWS API Documentation

Request Syntax

client.put_log_group_deletion_protection(
    logGroupIdentifier='string',
    deletionProtectionEnabled=True|False
)
type logGroupIdentifier:

string

param logGroupIdentifier:

[REQUIRED]

The name or ARN of the log group.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 512.

Pattern: [\.\-_/#A-Za-z0-9]+

Required: Yes

type deletionProtectionEnabled:

boolean

param deletionProtectionEnabled:

[REQUIRED]

Whether to enable deletion protection.

Type: Boolean

Required: Yes

returns:

None

CreateLogGroup (updated) Link ¶
Changes (request) 
{'deletionProtectionEnabled': 'boolean'}

Creates a log group with the specified name. You can create up to 1,000,000 log groups per Region per account.

You must use the following guidelines when naming a log group:

  • Log group names must be unique within a Region for an Amazon Web Services account.

  • Log group names can be between 1 and 512 characters long.

  • Log group names consist of the following characters: a-z, A-Z, 0-9, '_' (underscore), '-' (hyphen), '/' (forward slash), '.' (period), and '#' (number sign)

  • Log group names can't start with the string aws/

When you create a log group, by default the log events in the log group do not expire. To set a retention policy so that events expire and are deleted after a specified time, use PutRetentionPolicy.

If you associate an KMS key with the log group, ingested data is encrypted using the KMS key. This association is stored as long as the data encrypted with the KMS key is still within CloudWatch Logs. This enables CloudWatch Logs to decrypt this data whenever it is requested.

If you attempt to associate a KMS key with the log group but the KMS key does not exist or the KMS key is disabled, you receive an InvalidParameterException error.

See also: AWS API Documentation

Request Syntax

client.create_log_group(
    logGroupName='string',
    kmsKeyId='string',
    tags={
        'string': 'string'
    },
    logGroupClass='STANDARD'|'INFREQUENT_ACCESS'|'DELIVERY',
    deletionProtectionEnabled=True|False
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

A name for the log group.

type kmsKeyId:

string

param kmsKeyId:

The Amazon Resource Name (ARN) of the KMS key to use when encrypting log data. For more information, see Amazon Resource Names.

type tags:

dict

param tags:

The key-value pairs to use for the tags.

You can grant users access to certain log groups while preventing them from accessing other log groups. To do so, tag your groups and use IAM policies that refer to those tags. To assign tags when you create a log group, you must have either the logs:TagResource or logs:TagLogGroup permission. For more information about tagging, see Tagging Amazon Web Services resources. For more information about using tags to control access, see Controlling access to Amazon Web Services resources using tags.

  • (string) --

    • (string) --

type logGroupClass:

string

param logGroupClass:

Use this parameter to specify the log group class for this log group. There are three classes:

  • The Standard log class supports all CloudWatch Logs features.

  • The Infrequent Access log class supports a subset of CloudWatch Logs features and incurs lower costs.

  • Use the Delivery log class only for delivering Lambda logs to store in Amazon S3 or Amazon Data Firehose. Log events in log groups in the Delivery class are kept in CloudWatch Logs for only one day. This log class doesn't offer rich CloudWatch Logs capabilities such as CloudWatch Logs Insights queries.

If you omit this parameter, the default of STANDARD is used.

For details about the features supported by each class, see Log classes

type deletionProtectionEnabled:

boolean

param deletionProtectionEnabled:

Use this parameter to enable deletion protection for the new log group. When enabled on a log group, deletion protection blocks all deletion operations until it is explicitly disabled. By default log groups are created without deletion protection enabled.

returns:

None

DescribeLogGroups (updated) Link ¶
Changes (response) 
{'logGroups': {'deletionProtectionEnabled': 'boolean'}}

Returns information about log groups. You can return all your log groups or filter the results by prefix. The results are ASCII-sorted by log group name.

CloudWatch Logs doesn't support IAM policies that control access to the DescribeLogGroups action by using the aws:ResourceTag/key-name condition key. Other CloudWatch Logs actions do support the use of the aws:ResourceTag/key-name condition key to control access. For more information about using tags to control access, see Controlling access to Amazon Web Services resources using tags.

If you are using CloudWatch cross-account observability, you can use this operation in a monitoring account and view data from the linked source accounts. For more information, see CloudWatch cross-account observability.

See also: AWS API Documentation

Request Syntax

client.describe_log_groups(
    accountIdentifiers=[
        'string',
    ],
    logGroupNamePrefix='string',
    logGroupNamePattern='string',
    nextToken='string',
    limit=123,
    includeLinkedAccounts=True|False,
    logGroupClass='STANDARD'|'INFREQUENT_ACCESS'|'DELIVERY',
    logGroupIdentifiers=[
        'string',
    ]
)
type accountIdentifiers:

list

param accountIdentifiers:

When includeLinkedAccounts is set to true, use this parameter to specify the list of accounts to search. You can specify as many as 20 account IDs in the array.

  • (string) --

type logGroupNamePrefix:

string

param logGroupNamePrefix:

The prefix to match.

type logGroupNamePattern:

string

param logGroupNamePattern:

If you specify a string for this parameter, the operation returns only log groups that have names that match the string based on a case-sensitive substring search. For example, if you specify DataLogs, log groups named DataLogs, aws/DataLogs, and GroupDataLogs would match, but datalogs, Data/log/s and Groupdata would not match.

If you specify logGroupNamePattern in your request, then only arn, creationTime, and logGroupName are included in the response.

type nextToken:

string

param nextToken:

The token for the next set of items to return. (You received this token from a previous call.)

type limit:

integer

param limit:

The maximum number of items returned. If you don't specify a value, the default is up to 50 items.

type includeLinkedAccounts:

boolean

param includeLinkedAccounts:

If you are using a monitoring account, set this to true to have the operation return log groups in the accounts listed in accountIdentifiers.

If this parameter is set to true and accountIdentifiers contains a null value, the operation returns all log groups in the monitoring account and all log groups in all source accounts that are linked to the monitoring account.

The default for this parameter is false.

type logGroupClass:

string

param logGroupClass:

Use this parameter to limit the results to only those log groups in the specified log group class. If you omit this parameter, log groups of all classes can be returned.

Specifies the log group class for this log group. There are three classes:

  • The Standard log class supports all CloudWatch Logs features.

  • The Infrequent Access log class supports a subset of CloudWatch Logs features and incurs lower costs.

  • Use the Delivery log class only for delivering Lambda logs to store in Amazon S3 or Amazon Data Firehose. Log events in log groups in the Delivery class are kept in CloudWatch Logs for only one day. This log class doesn't offer rich CloudWatch Logs capabilities such as CloudWatch Logs Insights queries.

For details about the features supported by each class, see Log classes

type logGroupIdentifiers:

list

param logGroupIdentifiers:

Use this array to filter the list of log groups returned. If you specify this parameter, the only other filter that you can choose to specify is includeLinkedAccounts.

If you are using this operation in a monitoring account, you can specify the ARNs of log groups in source accounts and in the monitoring account itself. If you are using this operation in an account that is not a cross-account monitoring account, you can specify only log group names in the same account as the operation.

  • (string) --

rtype:

dict

returns:

Response Syntax

{
    'logGroups': [
        {
            'logGroupName': 'string',
            'creationTime': 123,
            'retentionInDays': 123,
            'metricFilterCount': 123,
            'arn': 'string',
            'storedBytes': 123,
            'kmsKeyId': 'string',
            'dataProtectionStatus': 'ACTIVATED'|'DELETED'|'ARCHIVED'|'DISABLED',
            'inheritedProperties': [
                'ACCOUNT_DATA_PROTECTION',
            ],
            'logGroupClass': 'STANDARD'|'INFREQUENT_ACCESS'|'DELIVERY',
            'logGroupArn': 'string',
            'deletionProtectionEnabled': True|False
        },
    ],
    'nextToken': 'string'
}

Response Structure

  • (dict) --

    • logGroups (list) --

      An array of structures, where each structure contains the information about one log group.

      • (dict) --

        Represents a log group.

        • logGroupName (string) --

          The name of the log group.

        • creationTime (integer) --

          The creation time of the log group, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.

        • retentionInDays (integer) --

          The number of days to retain the log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, and 3653.

          To set a log group so that its log events do not expire, use DeleteRetentionPolicy.

        • metricFilterCount (integer) --

          The number of metric filters.

        • arn (string) --

          The Amazon Resource Name (ARN) of the log group. This version of the ARN includes a trailing :* after the log group name.

          Use this version to refer to the ARN in IAM policies when specifying permissions for most API actions. The exception is when specifying permissions for TagResource, UntagResource, and ListTagsForResource. The permissions for those three actions require the ARN version that doesn't include a trailing :*.

        • storedBytes (integer) --

          The number of bytes stored.

        • kmsKeyId (string) --

          The Amazon Resource Name (ARN) of the KMS key to use when encrypting log data.

        • dataProtectionStatus (string) --

          Displays whether this log group has a protection policy, or whether it had one in the past. For more information, see PutDataProtectionPolicy.

        • inheritedProperties (list) --

          Displays all the properties that this log group has inherited from account-level settings.

          • (string) --

        • logGroupClass (string) --

          This specifies the log group class for this log group. There are three classes:

          • The Standard log class supports all CloudWatch Logs features.

          • The Infrequent Access log class supports a subset of CloudWatch Logs features and incurs lower costs.

          • Use the Delivery log class only for delivering Lambda logs to store in Amazon S3 or Amazon Data Firehose. Log events in log groups in the Delivery class are kept in CloudWatch Logs for only one day. This log class doesn't offer rich CloudWatch Logs capabilities such as CloudWatch Logs Insights queries.

          For details about the features supported by the Standard and Infrequent Access classes, see Log classes

        • logGroupArn (string) --

          The Amazon Resource Name (ARN) of the log group. This version of the ARN doesn't include a trailing :* after the log group name.

          Use this version to refer to the ARN in the following situations:

        • deletionProtectionEnabled (boolean) --

          Indicates whether deletion protection is enabled for this log group. When enabled, deletion protection blocks all deletion operations until it is explicitly disabled.

    • nextToken (string) --

      The token for the next set of items to return. The token expires after 24 hours.