CloudWatch pricing is a set of separate items: metrics per metric and month, API requests per 1,000, alarms per alarm and month, dashboards per dashboard and month, logs per GB ingested by log class, per GB-month stored and per GB scanned in Logs Insights, plus delivery to S3 or Firehose, canary runs for Synthetics, rules and events for Contributor Insights and GB for Container Insights, Application Signals and Database Insights. On the bill, log ingestion almost always dominates, because a GB of ingestion in Frankfurt costs about twenty times a GB-month of storage and because every service and every function writes logs without meaning to.
Pricing dimensions
CloudWatch is not one service with one price but a dozen services with a unit each under one product code. The AWS services' own metrics are free; what is paid for is custom metrics, detailed monitoring, alarms, dashboards, queries and above all logs. Every item carries its own usage type.
| Dimension | Unit | What drives it | Optional |
|---|---|---|---|
| Custom metrics | Metric per month in four tiers by count; the first ten free | Every combination of metric name and dimensions an agent, a service with detailed monitoring or the embedded metric format reports, prorated by hours | Yes |
| API requests | Per 1,000 requests, GetMetricData per 1,000 metrics; the first million free | Dashboards, queries, third-party tools that fetch metrics | Yes |
| Alarms | Alarm per month: standard, high-resolution (10 or 30 seconds) at three times, composite at five times; the first ten free | Every alarm per metric; an alarm on a Metrics Insights query per analysed metric | Yes |
| Dashboards | Dashboard per month; the first three free | Every dashboard beyond three, used or not | Yes |
| Logs: ingestion | GB by log class: Standard, Infrequent Access at half; logs vended by AWS services in tiers; the first 5 GB a month free | Every line a function, container, agent or service writes to CloudWatch Logs, measured uncompressed | No |
| Logs: storage | GB-month, measured compressed, by class | Everything that sits after ingestion until the retention period expires; forever without one | No |
| Logs: queries | GB scanned in Logs Insights; Live Tail per minute after the first 1,800 a month | Every query over its time range and log groups, including the queries behind dashboards | Yes |
| Logs: delivery | GB to S3 or Firehose in tiers, plus conversion to Parquet per GB | Subscriptions and deliveries from log groups | Yes |
| Synthetics, Contributor Insights, RUM | Canary run; rule per month plus events per million; RUM events per 100,000 | Every canary run, every rule, every session | Yes |
| Container Insights, Application Signals, Database Insights | GB ingested, signals per million, vCPU- or ACU-hour of the monitored database | Every cluster, service or database with observation enabled | Yes |
| Purchase option | None; neither a reservation nor a Savings Plan |
A custom metric is every combination of namespace, metric name and dimension values: one metric with the dimension instance ID across 200 instances is 200 metrics, and an agent that reports ten system metrics per host produces ten metrics per host. The embedded metric format turns every dimension combination in the logs into a metric, and detailed monitoring for EC2 turns the free five-minute metrics into paid one-minute metrics per instance. The tier price falls with the number of metrics in the account, and the count is prorated by hours, so short-lived metrics cost little.
Logs are charged in three places: at ingestion per GB, uncompressed, at the highest rate; in storage per GB-month, compressed and therefore smaller; and at query time per GB scanned. The Infrequent Access log class halves ingestion for log groups that are rarely read and drops Live Tail, metric filters and alarms on the content in return; Standard keeps everything. Logs vended by AWS services such as VPC Flow Logs, CloudFront logs and WAF logs carry tiered rates of their own. The retention period is the only mechanism that frees storage again; a log group without one grows until someone sets it. The mechanics across all three providers are set side by side in observability, logging and monitoring.
How it appears in your billing data
In the Cost and Usage Report every item carries the product code AmazonCloudWatch, the logs included, and lineItem/Operation separates them: PutLogEvents for ingestion, StartQuery for Logs Insights, MetricStorage for metrics; lineItem/ResourceId names the ARN of the log group, the alarm or the dashboard, and the usage type's prefix is the region code, EUC1 for Frankfurt. Ingestion appears as EUC1-DataProcessing-Bytes for the Standard class and EUC1-DataProcessingIA-Bytes for Infrequent Access, vended logs as EUC1-VendedLog-Bytes with tiers and with suffixes such as -CFLogs or -WAFLogs, storage as EUC1-TimedStorage-ByteHrs and EUC1-TimedStorage-IA-ByteHrs, queries as EUC1-DataScanned-Bytes, Live Tail as EUC1-Logs-LiveTail, delivery as EUC1-S3-Egress-Bytes and EUC1-FH-Egress-Bytes.
Metrics appear as EUC1-CW:MetricMonitorUsage in metric-months with the tiers as separate lines, API requests as EUC1-CW:Requests and EUC1-CW:GMD-Metrics for GetMetricData, alarms as EUC1-CW:AlarmMonitorUsage, EUC1-CW:HighResAlarmMonitorUsage and EUC1-CW:CompositeAlarmMonitorUsage, dashboards as DashboardsUsageHour without a region code, because they are charged globally. Synthetics appears as EUC1-CW:Canary-runs, Contributor Insights as EUC1-CW:ContributorInsightRules and EUC1-CW:ContributorInsightEvents, Container Insights with enhanced observability as EUC1-CW:OTEL:Bytes:EKS-CI and Application Signals as EUC1-Application-Signals. The free allowances appear as Global-DataProcessing-Bytes, Global-TimedStorage-ByteHrs, Global-CW:MetricMonitorUsage and Global-CW:AlarmMonitorUsage at 0 across all regions.
What the report delivers per log group is GB of ingestion and storage; what it does not deliver is which function or container writes them, because the log group is the resource. Attribution to the originator runs through the group's name, /aws/lambda/<function> or /aws/eks/<cluster>, and through tags on the group; the metric IncomingBytes per group shows the spread without query cost. The report's structure is described in the AWS Cost and Usage Report. In the FOCUS export, ServiceName carries AmazonCloudWatch and x_ServiceCode AmazonCloudWatch; every item is ChargeCategory Usage, and the split between logs, metrics and alarms sits only in x_UsageType and x_Operation (FOCUS columns).
Levers
Configuration: the retention period is the first lever for storage and the ingestion class the first for ingestion: log groups that exist only for after-the-fact troubleshooting belong in Infrequent Access, groups without a period get one. The second is the volume at the source: log levels above debug, structured instead of verbose lines, and sampling for access logs, because ingestion is charged per uncompressed GB. The third is the metrics: agents that report only the needed metrics with the needed dimensions, and detailed monitoring only where one-minute resolution is needed. Metric filters on logs are free and replace queries that scan GB on every dashboard load.
Purchase option: there is none for CloudWatch; the tiers of metrics and vended logs apply by themselves with the account's volume.
Architecture: logs that are only archived belong through a subscription in S3 and Athena, because S3 storage is a fraction of CloudWatch storage and Athena costs less per GB scanned than Logs Insights (S3 pricing, Redshift, Athena and Glue). Container Insights and Lambda logs are the two sources that grow without intent; a function's logs are covered in Lambda pricing, a cluster's in shared cluster costs. CloudTrail and Config write their events to S3, not to CloudWatch Logs, and are described in CloudTrail, Config and security services.
Where it goes wrong
- One log group carries half the bill. A function or container in debug mode writes GB a day.
IncomingBytesper log group over seven days shows the originator; the log level is the correction. - Storage has grown for years. Log groups without a retention period keep everything. Lines with
TimedStorage-ByteHrsgrow every month; a period of 30 to 90 days for operational logs and a subscription to S3 for retention end it. - The dashboard scans on every load. A dashboard with Logs Insights widgets runs the queries on every load and pays per GB scanned. Metric filters or narrowed time ranges replace them.
- Metrics explode with dimensions. A metric with customer ID or request ID as a dimension produces a paid metric per value.
MetricMonitorUsagerises with cardinality; high-cardinality dimensions belong in logs, not in metrics. - Detailed monitoring on every instance. One-minute metrics for every EC2 instance pay several metrics per instance a month. Only instances behind auto scaling policies need them.
- High-resolution alarms everywhere. An alarm at 10-second resolution costs three times a standard alarm. The resolution belongs to the alarm that needs it.
- Infrequent Access switches alarms off. A log group in Infrequent Access loses metric filters and alarms on the content. Groups that alarms are built from stay in Standard.
Example
List prices in USD for Frankfurt (eu-central-1), read on 2026-10-21 from the AWS price list: ingestion costs USD 0.63 per GB in the Standard class and USD 0.315 in Infrequent Access, storage USD 0.0324 per GB-month in Standard, Logs Insights USD 0.0063 per GB scanned, delivery to S3 USD 0.285 per GB for the first 10 TB; custom metrics USD 0.30 per metric and month for the first 10,000 and USD 0.10 for the next 240,000; API requests USD 0.01 per 1,000; alarms USD 0.10, high-resolution USD 0.30 and composite USD 0.50 a month; dashboards USD 3.00 a month beyond the first three; Synthetics USD 0.0016 per canary run; Contributor Insights USD 0.50 per rule and month plus USD 0.025 per million events; Container Insights with enhanced observability USD 0.08 per GB.
An account whose functions and containers write 100 GB of logs a day pays 3,000 GB × 0.63 = USD 1,890.00 of ingestion a month less USD 3.15 of free allowance, and with 30 days of retention and compression to a fifth about 600 GB-months × 0.0324 = USD 19.44 of storage; the same volume in Infrequent Access costs USD 945.00 of ingestion. If a dashboard scans 500 GB a day in Logs Insights, 15,000 × 0.0063 = USD 94.50 come on top. 500 custom metrics cost USD 147.00 a month after the ten free ones, 50 standard alarms USD 4.00 after the ten free ones, five dashboards USD 6.00. Together that is about USD 2,158, of which ingestion carries 87 percent. The figures show that ingestion is the line that counts, that storage almost vanishes under a short retention, and that metrics, alarms and dashboards matter only in the thousands.
Sources
Read on 2026-10-21. Prices: Amazon CloudWatch pricing, AWS Price List, offer AmazonCloudWatch for eu-central-1. Billing data: analyzing CloudWatch billing and cost, Cost and Usage Report columns: lineItem, FOCUS 1.0 with AWS columns. Service: CloudWatch Logs log classes.