CloudWatchLogs / Client / delete_account_policy

delete_account_policy

CloudWatchLogs.Client.delete_account_policy(**kwargs)

Deletes a CloudWatch Logs account policy. This stops the account-wide policy from applying to log groups or data sources in the account. If you delete a data protection policy or subscription filter policy, any log-group level policies of those types remain in effect. If you delete a retention policy, the log groups that it applied to use their own retention setting, unless another retention policy applies to them. Deleting a retention policy does not restore log events that CloudWatch Logs has already deleted. This operation supports deletion of data source-based field index policies, including facet configurations, in addition to log group-based policies.

To use this operation, you must be signed on with the correct permissions depending on the type of policy that you are deleting.

  • To delete a data protection policy, you must have the logs:DeleteDataProtectionPolicy and logs:DeleteAccountPolicy permissions.

  • To delete a subscription filter policy, you must have the logs:DeleteSubscriptionFilter and logs:DeleteAccountPolicy permissions.

  • To delete a transformer policy, you must have the logs:DeleteTransformer and logs:DeleteAccountPolicy permissions.

  • To delete a field index policy, you must have the logs:DeleteIndexPolicy and logs:DeleteAccountPolicy permissions. If you delete a field index policy that included facet configurations, those facets will no longer be available for interactive exploration in the CloudWatch Logs Insights console. However, facet data is retained for up to 30 days.

  • To delete a retention policy, you must have the logs:DeleteRetentionPolicy and logs:DeleteAccountPolicy permissions. To preview the impact of deleting a retention policy, specify true for dryRun. A dry run requires the same permissions as the operation that it previews, and no additional permissions.

If you delete a field index policy, the indexing of the log events that happened before you deleted the policy will still be used for up to 30 days to improve CloudWatch Logs Insights queries.

See also: AWS API Documentation

Request Syntax

response = client.delete_account_policy(
    policyName='string',
    policyType='DATA_PROTECTION_POLICY'|'SUBSCRIPTION_FILTER_POLICY'|'FIELD_INDEX_POLICY'|'TRANSFORMER_POLICY'|'METRIC_EXTRACTION_POLICY'|'RETENTION_POLICY',
    dryRun=True|False
)
Parameters:

  • policyName (string) –

    [REQUIRED]

    The name of the policy to delete.

  • policyType (string) –

    [REQUIRED]

    The type of policy to delete.

  • dryRun (boolean) –

    Specifies whether to preview the impact of deleting the policy without deleting it. If you specify true, CloudWatch Logs does not delete the policy and returns the estimated impact in dryRunResult. The default is false.

    Specifying dryRun is valid only when you specify RETENTION_POLICY for policyType. Only one dry run can be in progress for an account at a time.

Return type:

dict

Returns:

Response Syntax

{
    'dryRunResult': {
        'totalMatchedLogGroups': 123,
        'increasedRetentionLogGroupCount': 123,
        'decreasedRetentionLogGroupCount': 123,
        'unchangedRetentionLogGroupCount': 123,
        'failedAnalysisCount': 123,
        'topLogGroupsImpacted': [
            {
                'logGroupName': 'string',
                'currentRetention': 'string',
                'proposedRetention': 'string',
                'storedBytes': 123
            },
        ]
    }
}

Response Structure

  • (dict) –

    • dryRunResult (dict) –

      The estimated impact of deleting the policy. This field is returned only when the request specifies dryRun as true.

      • totalMatchedLogGroups (integer) –

        The number of log groups in the scope of the policy that were analyzed. This value is the sum of increasedRetentionLogGroupCount, decreasedRetentionLogGroupCount, and unchangedRetentionLogGroupCount, and does not include log groups that could not be analyzed.

      • increasedRetentionLogGroupCount (integer) –

        The number of log groups whose effective retention period would become longer.

      • decreasedRetentionLogGroupCount (integer) –

        The number of log groups whose effective retention period would become shorter.

      • unchangedRetentionLogGroupCount (integer) –

        The number of log groups whose effective retention period would not change.

      • failedAnalysisCount (integer) –

        The number of log groups in the scope of the policy that could not be analyzed. These log groups are not included in totalMatchedLogGroups.

      • topLogGroupsImpacted (list) –

        Up to 20 log groups in the scope of the policy, sorted by stored bytes in descending order. This list can include log groups whose effective retention period would not change.

        • (dict) –

          Describes the estimated effect of an account-level retention policy change on one log group.

          • logGroupName (string) –

            The name of the log group.

          • currentRetention (string) –

            The current effective retention period of the log group, in days. A value of NEVER_EXPIRE indicates that log events in the log group never expire.

          • proposedRetention (string) –

            The effective retention period of the log group, in days, after the change. A value of NEVER_EXPIRE indicates that log events in the log group would never expire.

          • storedBytes (integer) –

            The number of bytes stored in the log group.

Exceptions