aws-delete-orphaned-cloudwatch-logs

Deletes CloudWatch log groups that were generated by AWS service resources that no longer exist

Developing Lambda functions, VPC flow logs, and other AWS services create CloudWatch logs can create an accumulation of CloudWatch log groups. Deleting these resources does not delete the corresponding CloudWatch log group (nor would you necessarily want it to), so these can build over time.

This function cross-references the log groups and determines which ones are orphaned. In view-only mode, the function will return the list of orphaned log groups; in non-view-only mode, it will delete them. You are strongly encouraged to use view-only mode first.

The function will need the following permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:DeleteLogGroup",
                "logs:DescribeLogGroups",
                "lambda:ListFunctions",
                "ec2:DescribeRegions",
                "ec2:DescribeVpcs",
                "sagemaker:ListNotebookInstances"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

To use view-only mode, pass in the parameter:

{ "view_only" : "true" }