Retention every CloudWatch log group carries, in every account.
This is a compliance number, not an operational one. Vanta's "Server logs
retained for 365 days" control reads retentionInDays off every log group it
can see, in every account connected to it, and nothing shorter passes. None of
the groups this covers needed a year to be debuggable — the shared Fargate
group in packages/ecs/pulumi ran on 5 days deliberately, because a service's
logs are read within hours of the alarm that sent you there.
It is one number rather than a prod/non-prod pair because retention is billed
as storage alone, never as ingestion: a year of every failing group in the
org — dev included — measured at ~$3/month total. That does not pay for a
second policy, nor for keeping per-resource Vanta deactivations current
against an account that mints fresh log groups on every PR preview deploy.
Retention every CloudWatch log group carries, in every account.
This is a compliance number, not an operational one. Vanta's "Server logs retained for 365 days" control reads
retentionInDaysoff every log group it can see, in every account connected to it, and nothing shorter passes. None of the groups this covers needed a year to be debuggable — the shared Fargate group inpackages/ecs/pulumiran on 5 days deliberately, because a service's logs are read within hours of the alarm that sent you there.It is one number rather than a prod/non-prod pair because retention is billed as storage alone, never as ingestion: a year of every failing group in the org — dev included — measured at ~$3/month total. That does not pay for a second policy, nor for keeping per-resource Vanta deactivations current against an account that mints fresh log groups on every PR preview deploy.