AWS cloudwatch cost suddenly increased, how to analysis ?

Problem

CloudWatch services is a managed service for storing, visualizing and analyzing logs and metrics data of application as well as AWS infrastructure. This service pricing model is simple pay per usage.

Identity Cost

Before cost analysis, confirm cost in two parts at "Bills" section and "Cost Explorer".

Login to AWS console and go to "Billing and Cost Management" section, click on "Bills" and check previous month cost with detailing way.

Click on "Cost Explorer", select below parameters -

1. Date Range - <Select last month>
2. Granularity - "Monthly"
3. Dimension - "Usage type"
4. Service - "Cloudwatch"
5. Usage type - Select all

Then check your most of cost consumed on which usage type.

Optimising Cost - CloudWatch Usage Types

Check which Cloudwatch log group ingesting more data

1. Open the Amazon CloudWatch console.
2. In the navigation pane, choose All Metrics, select Logs and then select Log Group Metrics.
3. For each of log groups, select the Incoming Bytes metric, and then choose the Graphed metrics tab.
4. For Statistic, choose Sum.
5. For Period, choose 30 Days.
6. Choose the Graph options tab and choose Number.
7. At the top right of the graph, choose custom, and then choose Absolute. Select a start and end date that corresponds with the last 30 days.
8. Check the size of data ingested by logs in graph.
9. Further take action to stop or disable Cloudwatch log group from service to reduce unncessary costs.

S3-Egress-Bytes($)

VPC flow logs, Global Accelerator flow logs, Route 53 Resolver query logs that are configured to be delivered into S3. This is in fact not related to the CloudWatch service, but it may appear on your CloudWatch bill anyway.

Cost Reduction Strategy

VPC flow logs can produce quite a lot of data in large AWS environments. Whilst they are helpful for analyzing network issues, you may want to consider whether flow logs are required in (a) CloudWatch logs and (b) S3. If you have configured both, you pay twice for every flow log event. Generally, sending flow logs to S3 and analyzing them with Athena when needed is cheaper.

Analysis: Is flow log archival to S3 necessary?