CloudWatch Pricing: Logs, Metrics and Alarms in 2026
Nov 6, 202615 min read
You pay per unit of each thing CloudWatch does, above a free allowance, because there are no tiers to select. A small team's bill is therefore set by log ingestion and custom metrics, not by the dashboards and alarms most budgets are built around.
By contrast, a plan-based product shows what that means. Activepieces lays out four tiers side by side on its pricing page, with the last one priced only on request, and you cannot evaluate that tier without calling sales.
The approver therefore signs for a named tier and knows the ceiling before usage begins.
There is no equivalent line to sign against in CloudWatch. What follows is a set of meters, and the approver is approving a rate, not a total.
CloudWatch pricing per meter
What CloudWatch is and what it bills for
CloudWatch is AWS's monitoring service. It collects logs from your applications and infrastructure, stores metrics, draws dashboards and fires alarms when a metric crosses a threshold.
Each of those functions is a separate meter. AWS charges logs on what you send in and on what you keep, and metrics per custom metric you publish, while dashboards, alarms and queries carry their own charges.
The meters are independent, and that's the audit point to settle first: whoever can alter logging or metric publication can, in effect, alter spend.
CloudWatch pricing sources and region checked
I read the rates in this article from the vendor's own page, aws.amazon.com/cloudwatch/pricing, on 5 November 2026. They're for the US East (N. Virginia) region, us-east-1.
AWS prices the same meter differently from region to region, so a team running in another region should reread the page for that region before reusing any calculation here.
If you are running this arithmetic for your own team, see what the same workload costs on Activepieces.
CloudWatch meter pricing and allowances
Signing against a figure means knowing which meter it belongs to. The Logs meters carry the largest rates: AWS lists Standard ingestion at $0.50 per GB, so every gigabyte your services print costs that much before anyone reads it.
The table below sets out the per-gigabyte rates I could confirm; AWS's own page remains the authority on the rest.
| Meter | Unit billed | Price |
|---|---|---|
| Logs ingestion, Standard | per GB | $0.50 |
| Logs ingestion, Infrequent Access | per GB | $0.25 |
| Logs storage | per GB per month | $0.03 |
| Logs Insights scan | per GB scanned | $0.005 |
| Vended logs, first 10 TB | per GB | $0.50 |
| Vended logs, 10–30 TB | per GB | $0.25 |
| Vended logs, 30–50 TB | per GB | $0.10 |
| Vended logs, 50 TB and above | per GB | $0.05 |
Scrutinise ingestion first. SignalCost gives the same $0.50 for Standard and $0.25 for Infrequent Access, so choosing the cheaper class halves the ingestion charge for logs you rarely query.
Metrics, dashboards and alarms
None of these charges per gigabyte. A custom metric, a dashboard and an alarm each accrue a charge for as long as it exists.
Logs: ingestion, storage and queries
$0.03 per GB per month is small beside ingestion at $0.50 per GB, so ingestion's the cost driver.
A Logs Insights scan costs $0.005 per GB, so a query over 200 GB costs $1, which makes repeated broad queries a modest but real line.
Vended logs are the logs AWS services such as network flow records emit on your behalf. They start at $0.50 per GB for the first 10 TB, so 10 TB of vended logs will cost $5,000.
The rate falls to $0.25 from 10 to 30 TB, $0.10 from 30 to 50 TB and $0.05 beyond that, meaning that scale (from 20 TB to 100 TB) reduces your per-unit cost by 80%.
Synthetics (scheduled canary checks), RUM (real-user monitoring in the browser), Application Signals (service-level tracking) and streams (log delivery to other destinations) are each metered separately. Price each from the AWS page before switching it on.
You will not find confirmed allowance figures for the Always Free tier in this article, because I have none and won't state any.
Five-person team's monthly bill
$147 a month is what a five-person team pays, priced at the table rates, for 200 GB of logs, 100 custom metrics, 20 alarms and 5 dashboards, or roughly $30 per engineer. Log ingestion's $100 of it, which means logging volume is the largest lever that moves the total. Every line below is quantity times rate, before any free allowance.
CloudWatch baseline workload cost by line
Two-thirds of the bill is one meter, because log ingestion costs $100 a month. According to CloudBurn, custom metrics cost [$30], which makes them the only other line worth an approval note. Dashboards cost $15, and alarms cost $2.
The table puts each line beside its cost at triple the log volume, so you can see which row moves.
| Bill line | Quantity | Cost at 200 GB logs | Cost at 600 GB logs |
|---|---|---|---|
| Log ingestion | 200 GB | $100 | $300 |
| Custom metrics | 100 | $30 | $30 |
| Dashboards | 5 | $15 | $15 |
| Alarms | 20 | $2 | $2 |
| Total | $147 | $347 |
$17 is what the alarms and dashboards that most budgets itemise come to together, about 12% of the baseline, so eliminating them would reduce your bill by only $17 monthly. Whoever signs off on monitoring spend is approving a log volume, not a dashboard count.
The same workload at triple the log volume
Tripling ingestion to 600 GB takes the log line from $100 to $300 and the total from $147 to $347. The other three lines don't change. The entire $200 increase comes from one meter, and logs rise from 68% of the bill to 86%.
Whoever signs off on monitoring spend is approving a log volume, not a dashboard count.
A verbose debug setting or a new service writing chatty logs can more than double the invoice without touching a single alarm or dashboard, so log ingestion is the line to cap, sample or review before launch.
Hidden CloudWatch fees and limits
Ingestion is the largest meter, but five further charges sit outside the headline rates. Each is set by a default or by another party's behaviour rather than by a decision you took.
Unless someone sets a retention period, new log groups keep data indefinitely. Storage therefore accrues every month with no end date.
Set a period on every group at creation, and where an audit or records requirement demands longer, record that requirement as the reason for the exception.
Add a dimension such as customer or request identifier and the count multiplies, because CloudWatch bills each distinct combination of metric name and dimension values as its own metric.
A single metric in the code can become thousands on the invoice. Keep dimensions to values with a short, fixed list.
Query, API and third-party tool charges
Enabling detailed monitoring fleet-wide enlarges the bill without warning. AWS charges it, which shortens the reporting interval for EC2 instances, per instance metric.
Separately, AWS bills GetMetricData by the number of metrics requested. A third-party monitoring product polling on a schedule generates these calls continuously, and the charge lands on your account, not the vendor's.
Vended logs and data transfer
When AWS services publish logs on your behalf, such as network flow logs, those fall under their own ingestion tier, separate from application logs.
Moving metrics or logs between regions adds data transfer charges on top.
Worth checking against a plan that does not meter every step: one credit covers a whole run on Activepieces.
The strongest case that CloudWatch is cheap enough
For a small team, CloudWatch is cheap enough as long as it stays a metrics-and-alarms tool; it stops being cheap only when log volume or metric cardinality grows.
The argument for staying on CloudWatch
No agent contract, no per-seat licence and no separate vendor to put through procurement: that is what CloudWatch asks of you.
It sits under the AWS agreement you already hold, so there's no new approval chain, no additional data-processing review and no second supplier to audit. It has a free tier, and the standard metrics your services emit cost nothing extra to collect.
For a team with a handful of services, alarms and dashboards are billed at flat, per-item rates, so that cost doesn't move when traffic does. A finance reviewer can check the figure once and expect it to hold.
When CloudWatch is not cheap enough
For metrics and alarms the objection holds; for logs it fails. Log ingestion is billed per gigabyte, so that line rises with traffic while the alarm line stays flat.
Custom metrics fail in a similar way: each new dimension value creates another billable metric, so cardinality grows the bill without anyone approving it.
Your break-even is the log volume at which that crossing occurs. Read it from your own worked bill, not from a general figure.
Re-reading that crossing weekly is a job for a scheduled Activepieces workflow that pulls your AWS cost data every Monday and posts a spend-by-meter summary to Slack.
Its pricing page lists 1 credit per flow run, whatever the number of steps, so adding a step to that report never changes what it costs, and the Free plan carries 1,000 credits a month with unlimited flows, so a weekly report uses four or five credits.
Three controls are marked on the log line, and each lowers its slope.
Retention sets an expiry on every log group. The Infrequent Access class moves rarely queried logs to the cheaper ingestion class. Sampling logs a fraction of routine events and keeps every error.
CloudWatch compared with Datadog, Grafana Cloud and Prometheus
For a small AWS-only team, CloudWatch is the model to price first. It bills inside the account you already audit, while the other three add a vendor, a data path or an operating burden.
Billing unit and free allowance side by side
The table sets the four models against the same five questions. Any cell marked "Unverified" was not confirmed against the vendor's own pricing page for this article, so confirm it there before it goes into a budget.
| Billing unit | Entry price | Free allowance | Log pricing | What the model punishes | |
|---|---|---|---|---|---|
| CloudWatch | Per meter: logs ingested, custom metrics, alarms, dashboards | Unverified | Exists; size unverified | Per volume ingested, plus storage | Chatty logs and high-cardinality custom metrics |
| Datadog | Per host, plus separate meters for logs and custom metrics | Unverified | Limited free tier; terms unverified | Per volume ingested, with a separate charge to index | Growing host count and unplanned custom metrics |
| Grafana Cloud | Usage: active series, log volume, and users on paid tiers | Unverified | Exists; size unverified | Per volume ingested | Series churn and extra seats |
| Prometheus | No licence fee; you pay for the servers and storage you run | No licence fee | Not applicable | Not included; needs a separate log system such as Loki | Staff time, and gaps in retention or availability |
Only Prometheus has no metered fee, and that is because the cost moves to your own engineers and infrastructure.
Which fits a small AWS-only team
CloudWatch fits best, because its charges land on the existing AWS invoice and fall under the approval and audit trail you already have. A new vendor means a new procurement approval, a data-processing review and a second place where logs leave your account.
Unless you need one view across several clouds or tools, Datadog and Grafana Cloud do not earn that review. Prometheus suits a team that can own its own operations and has agreed who is on call for the monitoring itself.
Reducing your CloudWatch bills
Work through five steps in order, beginning with the usage-type report, because each later step only makes sense once you know which meter is largest.
- Open Cost Explorer and group CloudWatch spend by usage type.
- Set a retention period on every log group.
- Move chatty, rarely read logs to the Infrequent Access log class.
- Cap the dimensions on custom metrics.
- Add an AWS Budgets alert on CloudWatch spend.
Find your top CloudWatch meter first
Before touching any setting, group by usage type, because the grouping tells you whether ingestion, storage or custom metrics leads the bill.
Cheapest of the levers, retention is also the one that deletes data, since log groups default to keeping it indefinitely. Get the owning team to sign off on a period per group before you set it, since expired logs can't be recovered for an audit.
If logs are written constantly but queried rarely, the Infrequent Access class lowers the ingestion rate. It also restricts some features, so check that your alarms and subscriptions don't depend on the group before moving it.
Setting CloudWatch budget limits and alerts
Finish with a budget alert scoped to CloudWatch alone, not the whole account, so a single meter drifting upward isn't hidden inside the total.
What Activepieces does about this
Activepieces does not change a single CloudWatch rate, and it does not replace the Budgets alert from the last step above. What it does is make the by-meter check a routine job instead of something someone remembers to do.
The article's argument is that the approver signs for a rate, not a total, so the useful thing to automate is a weekly comparison of each meter against the figure you signed.
The flow is short.
A schedule trigger fires each Monday, an HTTP or code step calls the Cost Explorer API grouped by usage type for CloudWatch only, and a condition compares the log ingestion line with the number in your worked bill, which was $100 in the five-person baseline.
If ingestion has moved, the flow posts the by-meter breakdown to Slack and names the log group owner. If it hasn't, it posts the summary and stops. Because the flow reads cost data rather than touching logging configuration, it can't change spend itself.
The cost of running it is on the pricing page and is easy to check. A run is 1 credit regardless of step count, and the Free plan includes 1,000 credits a month with unlimited flows, so a weekly report uses four or five.
The core is open source under the MIT licence, so a team that doesn't want another vendor in its audit trail can self-host it inside its own account. The enterprise features are under a separate commercial licence.
I have no named customer running this particular report, so I won't offer one.
Frequently asked questions
Once an alert has an owner and an approver, the remaining questions are mostly about who pays for what.
Is CloudWatch free for small projects?
Partly. CloudWatch includes free allowances on several meters, such as metrics, alarms, dashboards and log ingestion, but each allowance is separate and none covers the whole service.
A small project stays free only while every meter stays inside its own allowance, and log ingestion's usually the first to leave it.
Confirm the terms that apply to your account on the vendor's pricing page before relying on the allowance in a budget.
Does CloudWatch charge for alarms that never fire?
Yes. An alarm's billed for existing, not for firing, so a silent alarm costs the same as a noisy one.
Alarm type also matters: composite alarms and alarms built on metric math are priced differently from a plain alarm on one metric. Review the alarm list on a schedule and retire any that no longer has a named owner.
How do I see which log group costs the most?
$17 is what the alarms and dashboards that most budgets itemise come to together, about 12% of the baseline, so eliminating them would reduce your bill by only $17 monthly.
CloudWatch publishes an ingestion metric for each log group, which shows which groups receive the most data. Cost Explorer, filtered by usage type, shows what that volume cost.
Compare the two, and keep a note of the comparison for audit. Running Logs Insights queries to investigate is itself billed by data scanned, so narrow the time range first.
When a bill comes in higher than expected, it most often traces to log ingestion or custom metrics, not dashboards or alarms.
CloudWatch bills verbose application logging by volume received, and a custom metric with many dimension combinations as many separate metrics. A single debug setting left on in production, or a user identifier added as a dimension, can therefore change the invoice without anyone approving it.
Price the workload in the region where it will actually run, because rates differ between regions. Take the figures from that region's entry on the pricing page, not from a figure quoted for another region.
Related reading
References
Running the numbers
See what the same workload costs here.
Free forever plan, and every paid plan self-hosts at no extra cost.
See pricing Talk to sales
