CloudWatch Logs Intelligent Tiering: Field Guide for Financial-Grade Environments

After years of pushing verbose logs to S3 via async export — and paying the operational price for it — CloudWatch Logs finally delivers native tiering. The promise is simple: zero overhead, same query experience, lower cost for cold data. The reality for those operating financial-grade systems is slightly more complicated, and that is exactly where this field note begins.

The Problem This Feature Solves (and What It Does Not)

For years, the classic tension in financial observability was this: you need verbose logs for debugging and audit, but storing those logs in CloudWatch for 7 years — as required by Brazilian regulation for payment systems — was cost-prohibitive. The standard market solution was a parallel pipeline: CloudWatch for short retention (7-30 days), async export to S3 with lifecycle policies to Glacier, and a second set of tools for queries on cold data. That worked, but created real friction: two access planes, two IAM models, hours of latency to recover archived logs during an incident, and the risk of gaps between the export window and the active retention window.

Intelligent Tiering specifically solves the control plane consolidation problem: you keep everything in CloudWatch, with the same Insights API, the same Metric Filters, the same alarms — regardless of which tier the data is in. That is genuinely valuable. What it does not solve is the data sovereignty and portability question: if you have data residency requirements that demand audit logs exist in immutable storage with WORM (Write Once Read Many), CloudWatch — even with tiering — is not the right place to be the only copy. That distinction is critical and I will return to it.

CloudWatch Logs Intelligent Tiering Lifecycle

Automatic tier transition flow based on access patterns, with automatic promotion when accessing cold data and relevant integrations for financial-grade environments.

📥 Ingest Layer

• Application (EKS / Lambda) (compute)
• CloudWatch Agent / OTEL (edge)

🔥 Standard Tier (0–30 days)

• Standard Tier Full query speed Highest cost/GB (storage)
• CloudWatch Insights API (data)
• Metric Filters & Alarms (security)

❄️ Infrequent Access (30–90 days)

• Infrequent Access Lower cost/GB Same query API (storage)

🧊 Archive Instant Access (90+ days)

• Archive Instant Lowest cost/GB Instant retrieval (storage)

🏦 Compliance & Audit

• S3 Object Lock (WORM) Compliance mode (storage)
• Audit Pipeline (Kinesis + Glue) (data)

Flows

• app -> agent: structured logs
• agent -> std: ingest
• std -> ia: no access for 30 days → auto-downgrade
• ia -> arc: no access for 90 days → auto-downgrade
• arc -> std: access detected → promoted for 30 days
• ia -> std: access detected → promoted for 30 days
• std -> insights: unified query
• ia -> insights: unified query
• arc -> insights: unified query
• std -> metricfilter: real-time filtering
• std -> audit: parallel stream
• audit -> s3worm: immutable / WORM

Three-Tier Mechanics: What Actually Happens

The transition model is based on access patterns observed by CloudWatch, not on a declarative configuration per log group. This matters: you do not choose when a log group drops tiers — the service decides based on whether that group was accessed in the last 30 or 90 days. The Standard tier is the initial state and the most expensive per GB stored, but offers the lowest query latency and is the only tier where Metric Filters operate in real time. The Infrequent Access tier is activated automatically after 30 days without access, with a reduced per-GB cost — the Insights API continues to work identically, but there is a slightly different query cost you need to model in your FinOps. The Archive Instant Access tier kicks in after 90 days without access and represents the lowest storage cost; the keyword here is "Instant" — unlike S3 Glacier Deep Archive, there is no hours-long retrieval window. Data is immediately accessible via Insights.

Automatic promotion is bidirectional: when you run an Insights query on data in IA or Archive, CloudWatch automatically promotes that log group back to Standard tier for 30 days. This has non-obvious cost implications: an incident response runbook that makes broad historical queries can inadvertently promote hundreds of log groups to Standard, generating a cost spike that appears on your bill days later. In multi-account environments with AWS Organizations, this multiplies. Enabling is done at the account level — via Console, SDK, or CLI — which means you do not have per-log-group granularity to opt specific groups out of tiering without a separate account architecture.

Cost and Transition Reference Points (Field Estimates)

• 30d — Threshold for Infrequent Access. No access to log group for 30 days → automatic transition. No operator action required.
• 90d — Threshold for Archive Instant Access. No access for 90 days → lowest cost tier. Instant retrieval via Insights API.
• 30d — Automatic Promotion Duration. When accessing cold data, the log group is promoted back to Standard for 30 days — cost impact to model.
• 1 conta — Activation Granularity. Intelligent Tiering is enabled at account level, not per log group. Plan your account strategy accordingly.

Adoption Strategy in Regulated Financial Environments

For financial systems under BACEN, PCI-DSS, SOX, or LGPD, adopting Intelligent Tiering requires a risk analysis that goes beyond simply enabling the feature. The first point is segregation of log groups by criticality and regulatory regime. Audit logs for financial transactions — which need to be immutable, non-repudiable, and accessible for external audits — should not have CloudWatch as their only copy. The correct approach is to maintain a parallel stream via Kinesis Data Firehose to S3 with Object Lock in Compliance mode, ensuring the regulatory copy is WORM regardless of what happens in CloudWatch. Intelligent Tiering then operates on the operational copy in CloudWatch, which serves debugging, alerting, and MTTR — not as audit evidence.

The second point is query cost modeling for investigations. In financial environments, fraud investigations or security incidents frequently require historical queries spanning 6-18 months of data. With Intelligent Tiering, that data will be in the Archive Instant Access tier. Automatic promotion back to Standard for 30 days is operationally convenient, but means a 2-week investigation can result in weeks of Standard tier cost for log groups that would normally be Archive. You need to include this pattern in your FinOps cost model and potentially create dedicated log groups for active investigations, separate from production groups.

The third point is compatibility with existing access controls. Intelligent Tiering does not change the CloudWatch Logs IAM model — the same resource-based and identity-based policies continue to work. But if you use CloudWatch Logs resource policies to restrict cross-account access to specific log groups, you need to validate that those policies continue to work correctly when the log group is in IA or Archive tier. In my testing, the behavior is consistent, but staging validation is non-negotiable before enabling in production.

Playbook: Safely Enabling Intelligent Tiering in Production

1. Inventory and classify log groups by regime — Run aws logs describe-log-groups --query 'logGroups[*].[logGroupName,storedBytes,retentionInDays]' in each account. Classify into: (a) regulatory audit — requires parallel WORM copy; (b) critical operational — high volume, frequent access in first 30 days; (c) verbose/debug — ideal tiering candidate. Document this as an ADR before enabling anything.

2. Establish storage and query cost baseline — Capture current CloudWatch Logs costs (StorageBytes, IncomingBytes, DataScannedInBytes via Insights) using AWS Cost Explorer with service and tag granularity. Create a CloudWatch dashboard with cost metrics before enabling tiering — you will need this baseline to calculate real ROI and detect unexpected promotion spikes.

3. Validate parallel audit pipelines before enabling — For regulatory audit log groups, confirm the stream to S3 Object Lock is operational and that S3 retention policies are correct (Compliance mode, not Governance mode, for logs that cannot be deleted by any user, including root). Validate with aws s3api get-object-lock-configuration and confirm the bucket policy blocks deletion.

4. Enable on non-production account first — Use the Console or AWS CLI per the updated documentation to enable at account level. Enable in staging, wait 35 days to observe the first transition to IA, run your usual Insights queries, and validate results are identical. Monitor EstimatedCharges in CloudWatch Billing.

5. Create unexpected promotion detection alarm — Create a Metric Filter on CloudTrail that detects GetLogEvents or StartQuery on log groups in Archive tier. Configure an SNS alarm that notifies the FinOps team when more than N log groups are promoted within 24 hours. This alarm is your detector for runbooks making inadvertently broad historical queries.

6. Enable in production with gradual rollout per account — In AWS Organizations environments, enable account by account, starting with least critical workload accounts. Use AWS Config Rules to detect accounts where tiering is not yet enabled and where audit log groups do not have a parallel S3 pipeline configured. Document the final state in your observability runbook.

Field Tip: Separate Log Groups by Expected Access Pattern: Intelligent Tiering works best when you design your log groups with the access pattern in mind from the start. Verbose application logs (traces, debug) naturally go cold after 30 days and are perfect candidates. Audit logs for transactions, on the other hand, may be accessed months later during an investigation — and that investigation query will promote them back to Standard for 30 days. Consider using separate log groups for audit trail versus application debug, even if both come from the same application. This gives tiering the correct access profile for each category and prevents a fraud investigation from triggering promotion costs on your debug logs.

Observability of Tiering Itself: Monitoring the Monitor

An interesting architectural irony: the feature that reduces observability cost needs to be observed itself. There are three signals you should actively monitor after enabling Intelligent Tiering.

First, cost per tier via Cost Explorer. Cost Explorer exposes CloudWatch Logs costs with enough granularity to see the distribution across Standard, IA, and Archive. Create a specific budget alert for CloudWatch Logs and monitor the weekly trend for the first 8 weeks after activation. The expected pattern is a gradual reduction in Standard tier cost as log groups migrate to IA and Archive, but if you see spikes, that indicates unexpected promotions.

Second, Insights query latency per tier. Although the documentation states the query experience is the same regardless of tier, in practice queries covering Archive data may have slightly higher latency for very large volumes. Instrument your critical Insights queries with timestamps and publish latency as a custom CloudWatch metric. Define a latency SLO for incident response queries — for example, "historical queries up to 90 days must complete in under 60 seconds for volumes up to 10GB scanned".

Third, tier transition events via CloudTrail. CloudTrail records API calls related to tiering policy changes. Configure an EventBridge rule that captures Intelligent Tiering configuration change events and notifies the platform team — this is especially important in multi-account environments where a developer might inadvertently disable tiering on a production account. Combine this with AWS Config for continuous drift detection.

Anti-Patterns: What Not to Do with Intelligent Tiering

• Using CloudWatch as the only copy of regulatory audit logs. Intelligent Tiering does not make CloudWatch an immutable storage system. For logs that need to be legal or regulatory evidence (PCI-DSS, BACEN, SOX), you need a parallel copy in S3 Object Lock (Compliance mode). CloudWatch serves operations; S3 WORM serves compliance.
• Enabling tiering at account level without inventorying critical log groups first. Account-level activation is all-or-nothing — all log groups in the account become eligible for tiering. If you have critical application log groups accessed irregularly (e.g., monthly batch jobs), they may drop to Archive and the next job execution will promote them back, generating unnecessary cost.
• Assuming queries on Archive have the same cost as Standard. The CloudWatch Logs pricing model has distinct components for storage and queries (DataScannedInBytes). Check the updated pricing page for per-GB-scanned values in each tier — the difference can be significant for workloads with high volumes of historical queries.
• Removing S3 export pipelines immediately after enabling tiering. Before decommissioning any existing S3 export pipeline, validate for at least 90 days that Intelligent Tiering is working as expected, that costs are within the projected model, and that all incident response and audit queries work correctly across all three tiers.
• Ignoring regional unavailability. Intelligent Tiering is not available in Middle East (Bahrain) and Middle East (UAE). If you operate in multi-region architectures that include these regions, your log retention strategy needs to be differentiated per region — do not assume that enabling at the Organizations level will work uniformly.

Intelligent Tiering vs. Previous Log Retention Strategies

Frequently Asked Architect Questions

Does Intelligent Tiering affect existing Metric Filters?

Metric Filters operate only on data in the Standard tier in real time. Data that has already migrated to IA or Archive is not retroactively processed by Metric Filters. This means your Metric Filter-based alarms continue working for new data, but not for historical data returning to Standard via promotion. For alerts on historical data, use CloudWatch Alarms based on scheduled Insights queries.

Can I exclude specific log groups from tiering?

Not directly — tiering is enabled at the account level. The only way to exclude specific log groups is to keep them in a separate account where tiering is not enabled. For environments where you need fine-grained control, consider a dedicated account strategy for critical log groups that should not be tiered.

How does tiering interact with cross-account CloudWatch Logs Insights?

Cross-account queries via CloudWatch Observability Access Manager work regardless of tier. Automatic promotion also occurs when data is accessed via cross-account query — meaning a central observability account making historical queries can promote log groups in workload accounts. Monitor this actively if you use a centralized observability model.

Does tiering work with KMS-encrypted Log Groups?

Yes. Log groups encrypted with customer-managed KMS keys continue to work with Intelligent Tiering. Encryption is maintained across all tiers. Ensure the KMS key policy allows CloudWatch Logs to access the key — this does not change with tiering, but it is a silent failure point if the key policy is restrictive.

What is the impact on MTTR during incidents?

For incidents requiring analysis of recent data (last 30 days), the MTTR impact is zero — data is in Standard tier. For incidents requiring historical data (30-90 days or more), instant retrieval from Archive tier eliminates the hours-long latency that existed with S3/Glacier pipelines. This is a real MTTR improvement for fraud investigations and root cause analyses that need historical context.

AWS Well-Architected Lens

• security: Tiering does not alter the CloudWatch Logs security model, but requires attention: (1) KMS CMK policies must allow CloudWatch access across all tiers; (2) log group resource policies remain the access control mechanism — validate them after enabling tiering; (3) CloudTrail must log all CloudWatch Logs API calls, including GetLogEvents and StartQuery, to detect unauthorized access to historical data.
• reliability: Intelligent Tiering is managed by AWS — you have no control over the exact timing of transitions within the 30/90-day windows. For critical workloads that need data availability guarantees, document the expected behavior and include historical data recovery tests in your DR runbooks.
• performance: Automatic promotion when accessing cold data is instant for query purposes, but the log group stays in Standard for 30 days after promotion. For workloads with irregular but predictable access patterns (like quarterly audits), consider the promotion cost impact in your financial performance model.

Curator's Note: In my experience with financial-grade systems, the biggest trap is not technical — it is the temptation to oversimplify. Intelligent Tiering is genuinely good at reducing costs for verbose operational logs, and I would enable it in production without hesitation for that use case. But I would never remove the parallel pipeline to S3 Object Lock for regulatory audit logs — CloudWatch is not and never was an immutable storage system, and no tiering feature changes that. The lesson I learned the hard way: the cost of reconstructing audit evidence after a regulatory incident is orders of magnitude greater than the cost of keeping a Kinesis → S3 Object Lock pipeline running in parallel. Enable the tiering, capture the savings on debug logs, and keep your compliance architecture separate and untouched.

Verdict: Enable with Strategy, Not Blind Enthusiasm

CloudWatch Logs Intelligent Tiering is a solid feature that solves a real problem: the prohibitive cost of retaining verbose logs in CloudWatch for extended periods. The unified query experience and instant retrieval from the Archive tier are genuine differentiators compared to previous S3/Glacier export solutions. For teams that were running export pipelines solely to reduce storage costs — without WORM requirements — this feature can eliminate significant operational complexity.

For regulated financial environments, the recommendation is clear: enable Intelligent Tiering for operational and verbose logs, but maintain parallel pipelines to S3 Object Lock for any data with regulatory immutability requirements. Do not confuse control plane consolidation (what tiering delivers) with data immutability (what it does not deliver). Execute the 6-step playbook above, monitor unexpected promotions, and model query costs before decommissioning any existing infrastructure. The savings are real — but only if you do not pay the price of an inadequate compliance architecture later.

References

• AWS What's New: Amazon CloudWatch Logs announces intelligent tiering for storage (Jul 15, 2026)
• Amazon S3 Intelligent-Tiering Storage Class
• Amazon FSx Intelligent-Tiering for OpenZFS (AWS Blog, Dec 2024)
• CloudWatch Logs Intelligent Tiering — Modern Workspace Pro (Jul 16, 2026)
• AWS Well-Architected Framework — Cost Optimization Pillar
• Amazon S3 Object Lock — Using S3 Object Lock for compliance
• CloudWatch Logs — Resource Policies
• AWS Cost Anomaly Detection

Originally published at fernando.moretes.com. By Fernando F. Azevedo — Senior Solutions Architect.