API Gateway access logs cost: how to estimate ingestion and retention

Start with a calculator if you need a first-pass estimate, then use this guide to validate the assumptions and catch the billing traps.

This page is the logging-cost branch of the API Gateway cluster, not the core request-pricing page: it exists to model ingestion, retention, and query spend once you already know logging is a meaningful side bill.

If you are still deciding what belongs inside the API Gateway bill overall, go back to the pricing guide first.

Where the cost shows up

• Ingestion: GB ingested into your logging destination (often CloudWatch Logs).
• Storage: retained GB-month (retention policy creates the steady-state storage baseline).
• Queries/scans: log searches and dashboards (often the surprise during incidents).

If you already have a log pipeline, use measured ingestion and query scan volumes instead of estimating from first principles.

Step 1: estimate average bytes per log line

• Pick a representative window (normal traffic + a small slice of peak).
• Sample a few thousand log lines and compute average bytes/line (and p95 if sizes vary a lot).
• Watch the big fields: long headers, JWT claims, user agents, and referrers.

Step 2: convert requests into GB/day

Approximation: GB/day ~= requests/day x bytes/log / 1e9.

If you only have requests/month, use: requests/day ~= requests/month / 30.4.

Step 3: model retention (GB-month)

Retention creates a steady storage baseline. If you ingest 10 GB/day and retain 30 days, steady-state stored volume is roughly 300 GB.

Model retention separately from ingestion: they are different rate cards in many tools.

Step 4: add query/scan costs (often the surprise)

• Incident response: repeated broad searches can scan huge volumes.
• Dashboards: scheduled queries add predictable recurring scans.
• Bad filters: scanning unpartitioned data is expensive.

Tool: Log search/scan cost calculator.

How to reduce access log cost (without losing signal)

• Make the log format intentional: drop large headers; log stable identifiers; avoid duplicating payload fields.
• Separate “always-on” vs “debug”: keep a slim always-on format and enable verbose logging only during investigations.
• Retention by value: short retention for noisy success logs, longer retention for security signals where required.
• Prevent retry storms: timeouts and retries multiply both requests and log volume.

When this is not the right page

• If your main problem is measuring total API requests per month, go to Estimate API requests per month.
• If you need to define what belongs inside the core API Gateway bill versus transfer, logs, and adjacent services, go to API Gateway pricing.
• If the request and transfer model is already believable and you now need production changes, go to API Gateway cost optimization.

Validation checklist

• Validate requests/day from a representative window (include weekday/weekend patterns).
• Validate bytes/log using a real sample after finalizing the log format.
• Confirm retention policy (days) and whether logs are replicated/forwarded elsewhere.
• Estimate query frequency and scan size for dashboards and incident workflows.

Related links

Sources

• API Gateway logging: docs.aws.amazon.com
• CloudWatch Logs pricing: aws.amazon.com/cloudwatch/pricing

Related guides

Related calculators

FAQ