API Gateway Access Log Cost Calculator (CloudWatch Logs)

How to estimate bytes per log line (quick, reliable)

1. Export 100-1,000 log lines from a representative day.
2. Compute average bytes/line (and p95 if you want a peak scenario).
3. Re-check after changing log format: adding headers, user agents, and long paths can materially increase bytes per request.

High-leverage fixes for access log costs

• Log only the fields you use (drop large headers and rarely-used fields).
• Sample noisy endpoints (health checks, bots) instead of logging every request.
• Shorten retention for high-volume access logs and archive cold data if required.

API Gateway access-log cost is a bytes-per-request problem before it is a logging problem

This page works when you think in two steps: requests become log lines, and log lines become ingestion plus retained storage. The biggest misses usually come from underestimating bytes per line after adding headers, long paths, user agents, or extra structured fields.

• Request volume: the source traffic that determines how many access-log lines are produced.
• Bytes per line: the density lever that usually decides whether logs stay cheap or quietly grow expensive.
• Retention policy: the rule that converts ingestion into stored-log cost over time.

Where access-log estimates usually drift

• Average bytes per line are sampled once, then log format changes increase field count later.
• Teams focus on request growth while noisy headers or structured fields are the real cost multiplier.
• Retention is treated as an afterthought even though it creates the second half of the bill.
• Scan and dashboard behavior are forgotten, so the logging month is under-modeled.

What to review before trusting the access-log baseline

• Sample real log lines and re-sample after every format change that adds fields or headers.
• Separate ingestion, retention, and query behavior so one logging dimension does not hide the others.
• Set explicit retention tiers for high-volume access logs instead of letting them inherit longer defaults.
• Use endpoint sampling or field reduction before assuming retention is the only lever.

Baseline vs verbose-log access scenarios

How to review the first real access-log month

• Check whether the miss came from request volume, bytes per line, or retention policy before changing the whole estimate.
• Review ingestion GB/day, retained GB-month, and query scan behavior together because all three can move at once.

Next steps