Lambda is emitting a large volume of detailed logs to CloudWatch Logs, and log storage cost is rising. You want to retain logs only for the period needed for investigation and automatically delete older logs. Which setting is the most appropriate?

Explanation

Setting a Retention period on CloudWatch Logs automatically deletes logs older than the specified period. It is effective for controlling log storage cost.

Per-choice explanations

Practical Use

CloudWatch Logs log groups support a Retention period that can be set from 1 day to 10 years (or never expire). The default is "Never Expire," so as services such as Lambda, ECS, and API Gateway continue to run, logs accumulate indefinitely and storage charges (GB per month) keep rising. In practice, you should always set a Retention period when the log group is created or shortly after operation begins, retaining logs only for the period needed for investigation or audit (commonly 14 to 90 days). For logs that must be kept long term (audit or compliance requirements), the standard pattern is to forward them to S3 using Subscription Filters or Export tasks and then tier them to Glacier or Deep Archive with S3 Lifecycle rules. The long-term storage unit price for S3 is significantly lower than for CloudWatch Logs, and Athena can be used for log analysis. CloudWatch Logs Insights provides powerful analysis queries, but it is billed by scanned data volume, so cost estimation is needed when frequent large queries are expected. On SAA-C03, requirements such as "reduce CloudWatch Logs cost," "manage log retention," and "automatic deletion" point to setting a Retention period. Exposing logs publicly (a security violation), maximizing the Lambda timeout (unrelated), and disabling API Gateway CORS (CORS is the browser same-origin policy control, which is a different purpose) are all incorrect. Long-term export to S3, the per-scan pricing of Logs Insights, and real-time forwarding via Subscription Filters are also asked in higher-level exams.