qnabot-on-aws
qnabot-on-aws copied to clipboard
Issue: QnABot logs Never Expire. Request: Add configurable log retention period for all CloudWatch log groups used by QnABot
Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
QnABot Lambda functions currently log to implicitly created CloudWatch log groups that default to 'Never Expire' - eg
This is problematic:
- as logs grow over time, incurring increasing cost
- logs may contain sensitive information from QnAbot requests that needs to be deleted after some days for policy compliance and to prevent legal liability / discoverability issues.
Describe the feature you'd like A clear and concise description of what you want to happen.
- QnABot main template should have a new parameter for CloudWatch logs retention period in days (with a default - say 30 days)
- All QnABot templates should be modified to explicitly create a CloudWatch log group for each Lambda function
- with an explicitly named log group based on the stack name for easier discovery
- with an explicitly set retention
eg something like this..
LambdaXXXLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName:
Fn::Sub: /${AWS::StackName}/lambda/LambdaXXX
RetentionInDays:
Ref: CloudWatchLogsExpirationInDays
and each associated Lambda function should reference it's explicit log group by adding the LoggingConfig
property:
LoggingConfig:
LogGroup:
Fn::Sub: /${AWS::StackName}/lambda/LambdaXXX
Additional context Add any other context or screenshots about the feature request here.