AWS CloudWatch S3 Tables Mirror Shares Retention Window, Not a Standalone Archive
AWS introduced a feature in June 2026 allowing CloudWatch Logs to mirror log groups into S3 Tables in Apache Iceberg format, queryable via standard SQL in Athena. A common misconception is that this creates a separate, long-term archive in S3, but AWS documentation clarifies that the S3 Tables copy shares the exact same retention period as the source log group. If a log group is set to expire after 30 days, the Iceberg data in S3 Tables also expires after 30 days — deleting the log group or a log stream removes the Iceberg data as well. The feature is better understood as a second query interface over the same data, enabling analytical workloads like multi-week aggregations and cross-dataset joins alongside CloudWatch's operational queries. Storage, compaction, and snapshot management costs are waived for the mirror, but it cannot substitute for a true tiered or long-term retention strategy.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in