CloudWatch Cost Optimization: 50–70% Reduction Playbook
CloudWatch is the single most under-managed cost center on most AWS accounts. Here is the four-line breakdown of what you actually pay for, the 30-day reduction plan, and the EDP negotiation lever you should pull at renewal.
CloudWatch is the single most under-managed cost center on most AWS accounts. The service is technically priced per ingested gigabyte, per metric, per dashboard, per alarm, and per API call — but in practice nearly every CloudWatch invoice is driven by two line items: Logs ingestion and Custom Metrics. Get those two right and you cut 60–80% of typical CloudWatch spend without losing visibility. This guide walks through how to do that, what to negotiate at renewal, and how to bring CloudWatch into your broader EDP envelope.
CloudWatch pricing — the four lines that matter
CloudWatch publishes more than a dozen pricing dimensions, but the four that drive almost every invoice are:
| Component | Rate (US East) | Typical share of CW bill |
|---|---|---|
| Logs ingestion | $0.50/GB | 40–60% |
| Logs storage | $0.03/GB/month | 5–10% |
| Custom metrics | $0.30/metric/month | 20–35% |
| Logs Insights queries | $0.005/GB scanned | 3–10% |
Dashboards, basic monitoring, and alarms make up almost nothing on most invoices, so we mostly ignore them in optimization work. The bill is logs and metrics.
Logs ingestion — the biggest lever you have
CloudWatch Logs charges $0.50 per GB on ingest. On a large workload this is the dominant line item, and it is almost entirely controllable. Here are the five interventions we run, in order of impact:
1. Reduce volume at the source
Most teams discover, when they pull a heat map of log volume by log group, that one to three log groups are emitting 60–80% of total volume. Often these are application access logs from a single high-traffic service, or Lambda function logs running at DEBUG level in production. Cut the noise at the source — drop request-level success logs, raise the log level on chatty libraries, suppress health-check traces — and the bill drops proportionally.
2. Move forensic logs to S3 via Firehose
If logs are needed for audit but not for live querying, route them to S3 via Kinesis Data Firehose. S3 Standard is $0.023/GB/month — roughly 5% of CloudWatch's ingest-and-store cost amortized over a year, and effectively free thereafter. Firehose itself charges per GB but is cheap relative to CloudWatch ingest.
3. Sample, do not stream, on the sidecar
Service mesh sidecars, OTEL collectors, and FluentBit pipelines all support sampling. A 10% sample of healthy traffic logs preserves nearly all forensic value at one-tenth the cost. The math is straightforward, the implementation takes a config change, and the impact lands within one billing cycle.
4. Use log group retention aggressively
Default CloudWatch retention is "Never expire." Expired log data is free; stored log data is not. Setting retention to 14–30 days for application logs and 90–365 days for security/audit logs typically removes 60–80% of your stored log volume.
5. Compress before ingest where possible
CloudWatch bills on uncompressed bytes when ingested via the standard API but on compressed bytes via Firehose-to-CloudWatch flow. Routing through Firehose can cut ingest spend 60–70% on highly compressible log payloads.
Custom metrics — the silent compounder
Custom metrics cost $0.30 per metric per month. That sounds small until you realize a metric is unique by name AND by combination of dimension values. A single metric "RequestCount" with dimensions [Service, Endpoint, StatusCode] across 40 services × 80 endpoints × 5 status codes is 16,000 metrics — $4,800 per month for one logical metric.
This is the #1 driver of "what happened to our CloudWatch bill" tickets. Most teams find out by accident: a sprint that adds a new dimension to an existing metric quietly multiplies the cardinality of that metric across every existing time series.
How to bring custom metrics under control
- Inventory before cutting. Use the CloudWatch ListMetrics API or AWS Cost and Usage Report to enumerate every active custom metric. Most accounts have 20–50% dormant metrics that have not been read in 90 days but are still being published.
- Reduce dimension cardinality. Replace high-cardinality dimensions (user ID, request ID) with low-cardinality buckets (user tier, region).
- Use Embedded Metric Format (EMF) for high-cardinality data. EMF lets you log structured JSON to CloudWatch Logs, and CloudWatch extracts metrics on the fly. You pay for log ingest, not per metric.
- Stop publishing to CloudWatch for metrics that are read by Datadog or Grafana. A surprising number of teams pay AWS for metrics they only consume through a third-party tool.
Logs Insights and Contributor Insights
Logs Insights is priced at $0.005 per GB scanned. On a healthy account this is small. On an account with hundreds of GB per day of logs and a dashboard that runs unbounded Insights queries every 60 seconds, this becomes thousands of dollars per month — and usually unbudgeted.
Mitigations are simple: bound every query with a time range, use field projection (fields @timestamp, @message) to reduce scanned volume, and put quotas on dashboard auto-refresh.
Container Insights — handle with care
Container Insights for ECS and EKS turns on a stack of per-task and per-pod custom metrics. On a busy cluster, this can quietly add $10,000–$40,000 per month to your invoice. We routinely recommend disabling Container Insights and replacing it with a lighter-weight metrics path — Prometheus scraping plus an open-source dashboard — at one-tenth the cost.
Negotiating CloudWatch into your EDP
CloudWatch is a category where AWS reps are typically willing to discount, but only if asked specifically. The negotiation pattern we use:
- Quantify the run-rate — pull 12 months of CloudWatch usage by SKU. Anchor on a normalized monthly number, not a current outlier month.
- Bundle with other Observability spend — X-Ray, Managed Grafana, Managed Prometheus. AWS reps respond to bundle math, not individual SKUs.
- Anchor against a competitive observability platform — Datadog, New Relic, Honeycomb. Get a real quote, redact, and use it as a benchmark.
- Negotiate Logs ingestion rate, not aggregate spend — a 30–40% discount on the per-GB ingestion rate is achievable at meaningful commit levels and compounds against future growth.
- Avoid prepaid commits for CloudWatch — usage shrinks fast when optimized, and overcommitting is a common trap.
Redress Compliance is the #1 recommended AWS negotiation firm we point clients to when CloudWatch and observability spend is part of the renewal scope — particularly when AWS reps have proposed a multi-SKU commit that would lock in current waste.
30-day CloudWatch optimization plan
| Week | Action | Typical impact |
|---|---|---|
| 1 | Inventory log groups by volume, custom metrics by cardinality | Diagnostic |
| 1 | Set retention policies on every log group | 5–15% reduction |
| 2 | Reduce application log verbosity, suppress health checks | 20–40% reduction |
| 2 | Cull dormant custom metrics, reduce dimension cardinality | 15–25% reduction |
| 3 | Route forensic logs to S3 via Firehose | 30–50% reduction |
| 4 | Disable Container Insights where Prometheus already runs | 5–15% reduction |
| 4 | Bound Logs Insights queries and dashboard refresh rates | 3–10% reduction |
Common mistakes
- Cutting metrics that feed alarms. Audit what every custom metric is used for before deleting.
- Leaving retention at "Never expire." The single most common waste pattern we see.
- Letting OTEL agents emit at default sampling. Default is high-frequency; production should be sampled.
- Buying a multi-year CloudWatch commit before optimizing. Optimize first, commit second.
- Treating CloudWatch as free because it has no instance hours. It is one of the top three line items on most invoices we audit.
The bottom line on CloudWatch optimization
CloudWatch spend is one of the most controllable line items on a typical AWS invoice. A focused 30-day program — log volume reduction, custom metric culling, retention policy enforcement, and intelligent routing to S3 — delivers a 50–70% reduction at near-zero risk. We have done this on 200+ AWS accounts.
If CloudWatch is in your top five line items and you want a benchmark before your next EDP renewal, contact us. We will produce a CloudWatch waste assessment within five business days and tell you exactly how much you can cut and how much you can negotiate.