us-east-1 に作られる AWS Chatbot のロググループに、CDK で保持期間を入れる方法を確かめてみた

export const CONFIGURATION_NAME = "verify-chatbot-logs";

export class ChatbotLogsStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const topic = new sns.Topic(this, "Topic", {
      topicName: "verify-chatbot-logs-topic",
    });

    const chatbotRole = new iam.Role(this, "ChatbotRole", {
      assumedBy: new iam.ServicePrincipal("chatbot.amazonaws.com"),
    });

    new chatbot.CfnSlackChannelConfiguration(this, "SlackChannel", {
      configurationName: CONFIGURATION_NAME,
      iamRoleArn: chatbotRole.roleArn,
      slackChannelId: SLACK_CHANNEL_ID,
      slackWorkspaceId: SLACK_WORKSPACE_ID,
      snsTopicArns: [topic.topicArn],
      loggingLevel: "INFO",
    });
  }
}

// bin/app.ts
new ChatbotLogsStack(app, "VerifyChatbotLogs", {
  env: { region: "ap-northeast-1" },
});

pnpm exec cdk deploy VerifyChatbotLogs --require-approval never

aws logs describe-log-groups --log-group-name-prefix /aws/chatbot --region ap-northeast-1
aws logs describe-log-groups --log-group-name-prefix /aws/chatbot --region us-east-1

ap-northeast-1   []
us-east-1        []

{
  "AlarmName": "verify-chatbot-logs-alarm",
  "AlarmDescription": "us-east-1 にログが出るかの検証用",
  "AWSAccountId": "<account>",
  "NewStateValue": "ALARM",
  "NewStateReason": "Threshold Crossed: 1 datapoint [1.0] was greater than the threshold (0.0).",
  "StateChangeTime": "2026-09-18T13:35:00.000+0000",
  "Region": "Asia Pacific (Tokyo)",
  "AlarmArn": "arn:aws:cloudwatch:ap-northeast-1:<account>:alarm:verify-chatbot-logs-alarm",
  "OldStateValue": "OK",
  "Trigger": {
    "MetricName": "Errors",
    "Namespace": "AWS/Lambda",
    "Statistic": "SUM",
    "Dimensions": [],
    "Period": 300,
    "EvaluationPeriods": 1,
    "ComparisonOperator": "GreaterThanThreshold",
    "Threshold": 0.0
  }
}

aws sns publish \
  --topic-arn arn:aws:sns:ap-northeast-1:<account>:verify-chatbot-logs-topic \
  --subject "ALARM: verify-chatbot-logs-alarm" \
  --message file://alarm.json \
  --region ap-northeast-1

aws logs get-log-events --log-group-name /aws/chatbot/verify-chatbot-logs \
  --log-stream-name <ストリーム名> --region us-east-1

Sending message to Slack (Workspace: <workspace-id>, Channel: aws-test) with title:
🚨 CloudWatch Alarm | verify-chatbot-logs-alarm | ap-northeast-1 | Account: <account>

new logs.LogRetention(this, "ChatbotLogRetention", {
  logGroupName: `/aws/chatbot/${CONFIGURATION_NAME}`,
  retention: logs.RetentionDays.TWO_WEEKS,
  // logGroupRegion を指定しない
});

Resources
[+] Custom::LogRetention ChatbotLogRetention
[+] AWS::IAM::Role LogRetention.../ServiceRole
[+] AWS::IAM::Policy LogRetention.../ServiceRole/DefaultPolicy
[+] AWS::Lambda::Function LogRetention...

pnpm exec cdk deploy VerifyChatbotLogs --require-approval never

aws logs describe-log-groups --log-group-name-prefix /aws/chatbot --region ap-northeast-1 \
  --query 'logGroups[].{logGroupName:logGroupName,retentionInDays:retentionInDays,storedBytes:storedBytes}'

// ap-northeast-1
[
    {
        "logGroupName": "/aws/chatbot/verify-chatbot-logs",
        "retentionInDays": 14,
        "storedBytes": 0
    }
]

// us-east-1
[
    {
        "logGroupName": "/aws/chatbot/verify-chatbot-logs",
        "retentionInDays": null,
        "storedBytes": 0
    }
]

let r = e.ResourceProperties.LogGroupRegion;            // 未指定なら undefined
let c = new i.CloudWatchLogsClient({ logger: console, region: r });
// Create / Update で CreateLogGroup（既存なら無視）→ PutRetentionPolicy

new logs.LogRetention(this, "ChatbotLogRetention", {
  logGroupName: `/aws/chatbot/${CONFIGURATION_NAME}`,
  logGroupRegion: "us-east-1",
  retention: logs.RetentionDays.TWO_WEEKS,
});

// ap-northeast-1
[]

// us-east-1
[
    {
        "logGroupName": "/aws/chatbot/verify-chatbot-logs",
        "retentionInDays": 14,
        "storedBytes": 0
    }
]

- Action:
    - logs:PutRetentionPolicy
    - logs:DeleteRetentionPolicy
  Effect: Allow
  Resource: "*"

aws logs delete-log-group --log-group-name /aws/chatbot/verify-chatbot-logs --region ap-northeast-1

props.logRetention && new logs.LogRetention(this, "LogRetention", {
  logGroupName: `/aws/chatbot/${props.slackChannelConfigurationName}`,
  retention: props.logRetention,
  role: props.logRetentionRole,
  logGroupRegion: "us-east-1",        // 固定値
  logRetentionRetryOptions: props.logRetentionRetryOptions
})

new chatbot.SlackChannelConfiguration(this, "SlackChannel", {
  // ...
  logRetention: logs.RetentionDays.TWO_WEEKS,
});

new logs.LogRetention(this, "ChatbotLogRetention", {
  logGroupName: `/aws/chatbot/${CONFIGURATION_NAME}`,
  logGroupRegion: "us-east-1",
  retention: logs.RetentionDays.TWO_WEEKS,
  removalPolicy: cdk.RemovalPolicy.DESTROY,
});

- Action: logs:DeleteLogGroup
  Effect: Allow
  Resource:
    Fn::Join:
      - ""
      - - "arn:"
        - Ref: AWS::Partition
        - ":logs:ap-northeast-1:"          # スタックのリージョン
        - Ref: AWS::AccountId
        - :log-group:/aws/chatbot/verify-chatbot-logs:*

Received response status [FAILED] from custom resource. Message returned:
User: arn:aws:sts::<account>:assumed-role/VerifyChatbotLogs-LogRetention... is not authorized
to perform: logs:DeleteLogGroup on resource:
arn:aws:logs:us-east-1:<account>:log-group:/aws/chatbot/verify-chatbot-logs
because no identity-based policy allows the logs:DeleteLogGroup action

grantDeleteLogGroup(logGroupName) {
  this.role.addToPrincipalPolicy(new iam.PolicyStatement({
    actions: ["logs:DeleteLogGroup"],
    resources: [Stack.of(this).formatArn({
      service: "logs",
      resource: "log-group",
      resourceName: `${logGroupName}:*`,
      arnFormat: ArnFormat.COLON_RESOURCE_NAME
    })]
  }));
}

const provider = this.ensureSingletonLogRetentionFunction(props);
props.removalPolicy === cdk.RemovalPolicy.DESTROY && provider.grantDeleteLogGroup(props.logGroupName);

this.logGroupArn = Stack.of(this).formatArn({ region: props.logGroupRegion, service: "logs", ... });

const logRetentionRole = new iam.Role(this, "LogRetentionRole", {
  assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
  managedPolicies: [
    iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole"),
  ],
});
logRetentionRole.addToPolicy(
  new iam.PolicyStatement({
    actions: ["logs:DeleteLogGroup"],
    resources: [
      `arn:aws:logs:us-east-1:${cdk.Stack.of(this).account}:log-group:${LOG_GROUP_NAME}:*`,
    ],
  }),
);

new logs.LogRetention(this, "ChatbotLogRetention", {
  logGroupName: LOG_GROUP_NAME,
  logGroupRegion: "us-east-1",
  retention: logs.RetentionDays.TWO_WEEKS,
  removalPolicy: cdk.RemovalPolicy.DESTROY,
  role: logRetentionRole,
});

- Action: logs:DeleteLogGroup
  Resource: arn:aws:logs:us-east-1:<account>:log-group:/aws/chatbot/verify-chatbot-logs:*
- Action:
    - logs:PutRetentionPolicy
    - logs:DeleteRetentionPolicy
  Resource: "*"
- Action: logs:DeleteLogGroup
  Resource: arn:aws:logs:ap-northeast-1:<account>:log-group:/aws/chatbot/verify-chatbot-logs:*

✅  VerifyChatbotLogs: destroyed

aws logs describe-log-groups --log-group-name-prefix /aws/chatbot --region us-east-1

[]

aws cloudformation delete-stack --stack-name VerifyChatbotLogs \
  --region ap-northeast-1 --retain-resources ChatbotLogRetentionB9B9A71C

aws logs delete-log-group --log-group-name /aws/chatbot/verify-chatbot-logs --region us-east-1

aws logs delete-log-group --log-group-name /aws/chatbot/verify-chatbot-logs --region ap-northeast-1