This finding is distinct from idle Lambda functions, which flag functions with zero invocations. An idle Lambda may still have a log group with no retention policy — and vice versa: a log group with unbounded retention may belong to an actively invoked function.
What Parsivex checks: a CloudWatch log group set to Never Expire with at least 1 GB of stored data and created more than 30 days ago.
What setting retention does: a retention policy prunes log events older than the configured window going forward. It does not immediately delete existing stored data. To reclaim storage from data already on disk, you may need a separate one-time cleanup after setting retention.
Remediation default: scripts use a 90-day retention period as a balance between operational debugging and storage savings. Compliance, audit, or security log groups often need longer retention — adjust before applying.
What triggers this finding
A CloudWatch log group with retention set to "Never Expire", allowing log data to accumulate indefinitely.
Typical fix
Set a retention period (e.g. 30, 90, or 365 days) appropriate for compliance and debugging needs.
Example savings
Varies by ingestion volume — high-traffic log groups can cost $10–$500+/month without retention.
See also: Severity and savings estimates for how Parsivex calculates figures on your report.