Thread by @oliverjumpertz

If you're using AWS Lambda, stop scrolling and find out how you can potentially save a few to a few thousand dollars a month.

I actually saved my employer 8k dollars a month from only two Lambda@Edge functions running for each CloudFront request:

Did you know that whenever you deploy a Lamda function to AWS, it automatically tries to create a log group for you and automatically starts to send even only access logs through that pipe?

Even if you don't have a single log statement within your Lambda function, the Lambda runtime will write access logs to CloudWatch.

AWS will happily bill you for that without you probably noticing, especially if you don't intentionally log anything.

If you never take a look at these logs, or if you don't even want them, there is only one way to disable them:

You have to restrict the Lambda's role from putting logs into CloudWatch by explicitly denying it access rights to CloudWatch.

When creating an IAM policy for your Lambda, make sure to use the following policy rule (either through CloudFormation, Terraform, or manually through the console):

It looks like you might break something, but that's not the case.

Denying the Lambda access to CloudWatch doesn't affect your function in any way.

You'll just be greeted with a warning whenever you visit the Lambda inside the AWS console.

If you don't need these logs, make sure to just set this policy and you're good to go.

If you need them, think about enabling logging only on demand (for example, if you're debugging issues).

CloudWatch can quickly grow your cost if you don't pay close attention.

That's it.

I hope this helps you save some or optimize your overall cloud costs on AWS.

If you enjoyed reading this, consider liking the thread, retweet the first tweet, and follow me (@oliverjumpertz) for more content like this.