CloudWatch Logs

AWS docs: https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/Welcome.html

CloudWatch Logs accepts the AWS JSON 1.1 API over the shared root endpoint with X-Amz-Target: Logs_20140328.<OperationName>. It also accepts Smithy RPC v2 CBOR at /service/Logs_20140328/operation/<OperationName> with Smithy-Protocol: rpc-v2-cbor and Content-Type: application/cbor.

Log group names are typically in the form /aws/lambda/<function-name> or /custom/<app-name>. Log stream names can be any valid string.

Tagging behavior:

• CreateLogGroup accepts tags and applies them as part of creating the group, so a rejected request creates nothing. TagLogGroup merges into the existing set.
• Tag maps are validated against AWS’s documented constraints before anything is written: at most 50 tags per log group, keys 1–128 characters, values 0–256 characters (an empty value is legal, an empty key is not), and no key may begin with the reserved aws: prefix. Violations return InvalidParameterException and leave the log group’s existing tags untouched. AWS::Logs::LogGroup passes its Tags through to the service and does not re-validate them.

Storage and retention behavior:

• In the SQLite-backed storage modes, log events live in a dedicated indexed table (logs_events), so appends and time-range reads stay fast regardless of stream size; pre-existing blob-format events are converted automatically by a one-time migration on first startup after upgrade.
• RetentionInDays (set via PutRetentionPolicy) is enforced: a periodic background sweep deletes events older than the group’s retention window in every storage mode. Groups with no retention policy keep events indefinitely.
• retentionInDays must be one of the values AWS documents — 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653. Anything else is rejected with InvalidParameterException before the log group is touched, over AWS JSON and RPC v2 CBOR alike. AWS::Logs::LogGroup inherits that check from the service instead of duplicating it, so a template carrying an unsupported RetentionInDays fails the resource and rolls the stack back.
• The same sweep also removes a log stream’s metadata (its DescribeLogStreams entry) once its last event has aged out of the retention window and the stream has no events left anywhere — matching real CloudWatch Logs, which eventually deletes empty log streams rather than leaving a stale entry behind forever. A stream is only removed once it has no persisted events, no buffered (not-yet-flushed) events, and a non-zero last-event timestamp — streams that have never received an event are never removed, regardless of age.
• Incoming events are briefly write-buffered per stream (~50 ms debounce, flushed early on bursts) to coalesce writes; buffers are flushed synchronously on graceful shutdown.

---

Summary

Category	✅ Supported	❌ Unsupported
Log groups	3
Log streams	3
Log events	4
Insights		3
Retention	2	1
Tagging	6

---

Endpoints

Log groups

Operation	Status	Notes	AWS Docs
CreateLogGroup	✅ Supported	Validates name; returns error on duplicate; applies create-time tags atomically with the group (kmsKeyId, logGroupClass and deletionProtectionEnabled are accepted but ignored)	docs
DescribeLogGroups	✅ Supported	Optional logGroupNamePrefix filter	docs
DeleteLogGroup	✅ Supported	Deletes group and all streams/events	docs

Log streams

Operation	Status	Notes	AWS Docs
CreateLogStream	✅ Supported	Validates group exists; returns error on duplicate	docs
DescribeLogStreams	✅ Supported	Optional logStreamNamePrefix filter	docs
DeleteLogStream	✅ Supported	Deletes stream and all its events	docs

Log events

Operation	Status	Notes	AWS Docs
PutLogEvents	✅ Supported	Accepts batch of events; sets ingestion time	docs
GetLogEvents	✅ Supported	startTime/endTime filtering; startFromHead	docs
FilterLogEvents	✅ Supported	Text patterns (AND, quoted, ?OR), JSON patterns ({ $.field op value } with &&/||, EXISTS, IS NULL), space-delimited patterns ([col, col = val, ...] with * glob, %regex%, numeric ops, &&/||, ellipsis); time range, stream name/prefix	docs
StartLiveTail	✅ Supported	AWS event-stream response with sessionStart/sessionUpdate; supports group identifiers, stream names/prefixes, and filter patterns	docs

Insights

Operation	Status	Notes	AWS Docs
StartQuery	❌ Unsupported	stub; returns 501	docs
GetQueryResults	❌ Unsupported	stub; returns 501	docs
PutMetricFilter	❌ Unsupported	stub; returns 501	docs

Retention

Operation	Status	Notes	AWS Docs
PutRetentionPolicy	✅ Supported	Sets retentionInDays on log group; values outside AWS’s documented set are rejected with InvalidParameterException before any state change	docs
DeleteRetentionPolicy	✅ Supported	Clears retention (sets to 0)	docs
PutSubscriptionFilter	❌ Unsupported	stub; returns 501	docs

Tagging

Operation	Status	Notes	AWS Docs
TagLogGroup	✅ Supported	Adds tags to a log group; enforces AWS’s key/value length, reserved aws: prefix and 50-tag limits before mutating	docs
UntagLogGroup	✅ Supported	Removes tags from a log group	docs
ListTagsLogGroup	✅ Supported	Returns tags for a log group	docs
TagResource	✅ Supported	Modern, ARN-addressed sibling of TagLogGroup (#1195); resolves resourceArn to a log group and shares its validation and storage	docs
UntagResource	✅ Supported	Modern, ARN-addressed sibling of UntagLogGroup (#1195)	docs
ListTagsForResource	✅ Supported	Modern, ARN-addressed sibling of ListTagsLogGroup (#1195)	docs