aws_cloudwatch_log_subscription_filter cost estimation
A subscription filter is free to define, but it streams matching log events in real time to a destination like Lambda or Kinesis, and that destination is where cost lands.
An aws_cloudwatch_log_subscription_filter forwards log events that match a pattern from a log group, in real time, to a destination: a Lambda function, a Kinesis data stream, or a Kinesis Firehose delivery stream. Defining the filter is free, and CloudWatch does not add a per-event charge for the subscription itself. What is not free is the destination that receives the stream.
The cost scales with how many events match and where they go. A Lambda destination is invoked continuously to process the stream and is billed per request and per GB-second, so a high-volume log group can drive real Lambda cost. A Kinesis data stream is billed per shard-hour and per PUT payload unit, and Firehose is billed per GB ingested and delivered, often into S3 which then stores the data. A broad filter pattern that matches most events forwards nearly the whole log stream, multiplying the destination's cost far beyond the log group's own ingestion charge.
The optimization is a tight filter pattern and a destination sized to the matched volume. Forward only the events you actually need downstream, and prefer Firehose to S3 for cheap bulk delivery over per-event Lambda when you are archiving rather than reacting. c3x prices the Lambda, Kinesis, or Firehose destination by its own meters and treats the subscription filter as the free routing rule it is.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "aws_cloudwatch_log_subscription_filter" "to_lambda" {
name = "errors-to-processor"
log_group_name = aws_cloudwatch_log_group.app.name
filter_pattern = "ERROR"
destination_arn = aws_lambda_function.log_processor.arn
}Pricing dimensions
What you actually pay for when you provision aws_cloudwatch_log_subscription_filter.
| Dimension | Unit | What's being charged |
|---|---|---|
| Subscription filter | free | Defining a subscription filter and matching events against it has no per-event charge. $0 |
| Lambda destination | per 1M requests + GB-second | A function processing the streamed events is billed per invocation and by memory times duration. $0.20 per 1M requests |
| Kinesis or Firehose destination | per shard-hour / per GB | A Kinesis stream is billed per shard-hour and payload; Firehose per GB ingested and delivered. Firehose: ~$0.029/GB ingested |
Optimization tips
Common ways to reduce aws_cloudwatch_log_subscription_filter cost without changing the workload.
Tighten the filter pattern
Cuts destination volume to relevant eventsA broad pattern forwards nearly the whole log stream to the destination, multiplying its cost. Match only the events you truly need downstream to keep destination volume low.
Use Firehose to S3 for bulk archival
Cheaper than per-event Lambda for archivalWhen you are archiving logs rather than reacting to them, Firehose delivery to S3 is far cheaper per GB than invoking Lambda per batch of events.
Right-size the Kinesis shard count
Kinesis bills per shard-hour whether or not shards are full. Match shard count to the matched event throughput so you do not pay for idle capacity.
FAQ
Does a CloudWatch subscription filter cost money?
The filter itself is free with no per-event charge. Cost lands on the destination: Lambda per request and GB-second, Kinesis per shard-hour and payload, or Firehose per GB ingested and delivered.
What drives the cost of a log subscription filter?
The volume of matching events and the destination that receives them. A broad pattern forwarding most of the log group to a Lambda or Kinesis destination can cost more than the log group's own ingestion. Tighten the pattern.
Which subscription destination is cheapest?
For bulk archival, Firehose delivery to S3 is usually cheapest per GB. For low-volume real-time reactions, Lambda is fine. Kinesis data streams cost per shard-hour continuously, so size shards to actual throughput.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including aws_cloudwatch_log_subscription_filter.