CloudWatch Logs without retention

What's the problem

Log group with no expiry → $0.03/GB/month accumulating indefinitely

How 6WAF detects it

• The threshold and data source are stated in the description above (CloudWatch metrics / AWS API describe calls) — this is the checker logic that runs in the scan, not separate marketing copy.
• Scanning uses a read-only IAM Role you deploy yourself (CloudFormation) — 6WAF stores no credentials, and you revoke access any time by deleting the stack.
• Unit prices used for estimates have a published source and an as-of date (us-east-1 baseline) — figures are a conservative lower bound, not inflated.