fix: update the retention of lambda CW logs to 365 to address the checkov scan finding -- CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"

nshalabh · nshalabh · commit f49640f86e25 · 2025-11-19T11:56:50.000-06:00
diff --git a/aws_sra_examples/terraform/solutions/inspector/configuration/variables.tf b/aws_sra_examples/terraform/solutions/inspector/configuration/variables.tf
@@ -72,7 +72,7 @@ variable "lambda_log_group_kms_key" {
 variable "lambda_log_group_retention" {
   description = "Specifies the number of days you want to retain log events"
   type        = number
-  default     = 14
+  default     = 365
 }
 
 variable "lambda_log_level" {

Original file line number	Diff line number	Diff line change
`@@ -72,7 +72,7 @@ variable "lambda_log_group_kms_key" {`
`72`	`72`	`variable "lambda_log_group_retention" {`
`73`	`73`	`description = "Specifies the number of days you want to retain log events"`
`74`	`74`	`type = number`
`75`		`- default = 14`
	`75`	`+ default = 365`
`76`	`76`	`}`
`77`	`77`
`78`	`78`	`variable "lambda_log_level" {`