feat(logging): add log_class parameter to all CloudWatch log groups

Brend-Smits · Brend-Smits · commit 4a3efc024817 · 2026-03-06T13:50:03.000+01:00
Extends the log_class parameter to all CloudWatch log groups managed by
the module, allowing users to set INFREQUENT_ACCESS class to reduce costs.

Log groups updated:
- runner-binaries-syncer (syncer)
- ami-housekeeper
- runners (scale-down, scale-up, ssm-housekeeper)
- runners/pool
- webhook/direct
- webhook/eventbridge (webhook, dispatcher)
- lambda module (shared)
- termination-watcher
- multi-runner (passthrough to all submodules)

Defaults to STANDARD for backward compatibility.
diff --git a/main.tf b/main.tf
@@ -136,6 +136,7 @@ module "webhook" {
   tracing_config                                = var.tracing_config
   logging_retention_in_days                     = var.logging_retention_in_days
   logging_kms_key_id                            = var.logging_kms_key_id
+  log_class                                     = var.log_class
 
   role_path                 = var.role_path
   role_permissions_boundary = var.role_permissions_boundary
@@ -227,6 +228,7 @@ module "runners" {
   tracing_config                                                 = var.tracing_config
   logging_retention_in_days                                      = var.logging_retention_in_days
   logging_kms_key_id                                             = var.logging_kms_key_id
+  log_class                                                      = var.log_class
   enable_cloudwatch_agent                                        = var.enable_cloudwatch_agent
   cloudwatch_config                                              = var.cloudwatch_config
   runner_log_files                                               = var.runner_log_files
@@ -306,6 +308,7 @@ module "runner_binaries" {
   tracing_config                  = var.tracing_config
   logging_retention_in_days       = var.logging_retention_in_days
   logging_kms_key_id              = var.logging_kms_key_id
+  log_class                       = var.log_class
 
   state_event_rule_binaries_syncer     = var.state_event_rule_binaries_syncer
   server_side_encryption_configuration = var.runner_binaries_s3_sse_configuration
@@ -348,6 +351,7 @@ module "ami_housekeeper" {
 
   logging_retention_in_days = var.logging_retention_in_days
   logging_kms_key_id        = var.logging_kms_key_id
+  log_class                 = var.log_class
   log_level                 = var.log_level
 
   role_path                 = var.role_path
@@ -369,6 +373,7 @@ locals {
     subnet_ids                = var.lambda_subnet_ids
     lambda_tags               = var.lambda_tags
     log_level                 = var.log_level
+    log_class                 = var.log_class
     logging_kms_key_id        = var.logging_kms_key_id
     logging_retention_in_days = var.logging_retention_in_days
     role_path                 = var.role_path
diff --git a/modules/ami-housekeeper/main.tf b/modules/ami-housekeeper/main.tf
@@ -51,6 +51,7 @@ resource "aws_cloudwatch_log_group" "ami_housekeeper" {
   name              = "/aws/lambda/${aws_lambda_function.ami_housekeeper.function_name}"
   retention_in_days = var.logging_retention_in_days
   kms_key_id        = var.logging_kms_key_id
+  log_group_class   = var.log_class
   tags              = var.tags
 }
 
diff --git a/modules/ami-housekeeper/variables.tf b/modules/ami-housekeeper/variables.tf
@@ -54,6 +54,17 @@ variable "logging_kms_key_id" {
   default     = null
 }
 
+variable "log_class" {
+  description = "The log class of the CloudWatch log group. Valid values are `STANDARD` or `INFREQUENT_ACCESS`."
+  type        = string
+  default     = "STANDARD"
+
+  validation {
+    condition     = contains(["STANDARD", "INFREQUENT_ACCESS"], var.log_class)
+    error_message = "`log_class` must be either `STANDARD` or `INFREQUENT_ACCESS`."
+  }
+}
+
 variable "lambda_subnet_ids" {
   description = "List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`."
   type        = list(string)
diff --git a/modules/lambda/main.tf b/modules/lambda/main.tf
@@ -56,6 +56,7 @@ resource "aws_cloudwatch_log_group" "main" {
   name              = "/aws/lambda/${aws_lambda_function.main.function_name}"
   retention_in_days = var.lambda.logging_retention_in_days
   kms_key_id        = var.lambda.logging_kms_key_id
+  log_group_class   = var.lambda.log_class
   tags              = var.lambda.tags
 }
 
diff --git a/modules/lambda/variables.tf b/modules/lambda/variables.tf
@@ -11,6 +11,7 @@ variable "lambda" {
     `log_level`: Logging level for lambda logging. Valid values are  'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'.
     `logging_kms_key_id`: Specifies the kms key id to encrypt the logs with
     `logging_retention_in_days`: Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653.
+    `log_class`: The log class of the CloudWatch log group. Valid values are `STANDARD` or `INFREQUENT_ACCESS`.
     `memory_size`: Memory size limit in MB of the lambda.
     `metrics_namespace`: Namespace for the metrics emitted by the lambda.
     `name`: The name of the lambda function.
@@ -35,6 +36,7 @@ variable "lambda" {
     handler                   = string
     lambda_tags               = optional(map(string), {})
     log_level                 = optional(string, "info")
+    log_class                 = optional(string, "STANDARD")
     logging_kms_key_id        = optional(string, null)
     logging_retention_in_days = optional(number, 180)
     memory_size               = optional(number, 256)
diff --git a/modules/multi-runner/ami-housekeeper.tf b/modules/multi-runner/ami-housekeeper.tf
@@ -24,6 +24,7 @@ module "ami_housekeeper" {
 
   logging_retention_in_days = var.logging_retention_in_days
   logging_kms_key_id        = var.logging_kms_key_id
+  log_class                 = var.log_class
   log_level                 = var.log_level
 
   role_path                 = var.role_path
diff --git a/modules/multi-runner/runner-binaries.tf b/modules/multi-runner/runner-binaries.tf
@@ -22,6 +22,7 @@ module "runner_binaries" {
   tracing_config                   = var.tracing_config
   logging_retention_in_days        = var.logging_retention_in_days
   logging_kms_key_id               = var.logging_kms_key_id
+  log_class                        = var.log_class
   state_event_rule_binaries_syncer = var.state_event_rule_binaries_syncer
 
   server_side_encryption_configuration = var.runner_binaries_s3_sse_configuration
diff --git a/modules/multi-runner/runners.tf b/modules/multi-runner/runners.tf
@@ -76,6 +76,7 @@ module "runners" {
   tracing_config                                                 = var.tracing_config
   logging_retention_in_days                                      = var.logging_retention_in_days
   logging_kms_key_id                                             = var.logging_kms_key_id
+  log_class                                                      = var.log_class
   enable_cloudwatch_agent                                        = each.value.runner_config.enable_cloudwatch_agent
   cloudwatch_config                                              = try(coalesce(each.value.runner_config.cloudwatch_config, var.cloudwatch_config), null)
   runner_log_files                                               = each.value.runner_config.runner_log_files
diff --git a/modules/multi-runner/termination-watcher.tf b/modules/multi-runner/termination-watcher.tf
@@ -9,6 +9,7 @@ locals {
     security_group_ids        = var.lambda_security_group_ids
     subnet_ids                = var.lambda_subnet_ids
     log_level                 = var.log_level
+    log_class                 = var.log_class
     logging_kms_key_id        = var.logging_kms_key_id
     logging_retention_in_days = var.logging_retention_in_days
     role_path                 = var.role_path
diff --git a/modules/multi-runner/variables.tf b/modules/multi-runner/variables.tf
@@ -327,6 +327,17 @@ variable "logging_kms_key_id" {
   default     = null
 }
 
+variable "log_class" {
+  description = "The log class of the CloudWatch log groups. Valid values are `STANDARD` or `INFREQUENT_ACCESS`."
+  type        = string
+  default     = "STANDARD"
+
+  validation {
+    condition     = contains(["STANDARD", "INFREQUENT_ACCESS"], var.log_class)
+    error_message = "`log_class` must be either `STANDARD` or `INFREQUENT_ACCESS`."
+  }
+}
+
 variable "lambda_s3_bucket" {
   description = "S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly."
   type        = string
diff --git a/modules/multi-runner/webhook.tf b/modules/multi-runner/webhook.tf
@@ -29,6 +29,7 @@ module "webhook" {
   tracing_config                                = var.tracing_config
   logging_retention_in_days                     = var.logging_retention_in_days
   logging_kms_key_id                            = var.logging_kms_key_id
+  log_class                                     = var.log_class
 
   role_path                 = var.role_path
   role_permissions_boundary = var.role_permissions_boundary
diff --git a/modules/runner-binaries-syncer/runner-binaries-syncer.tf b/modules/runner-binaries-syncer/runner-binaries-syncer.tf
@@ -70,6 +70,7 @@ resource "aws_cloudwatch_log_group" "syncer" {
   name              = "/aws/lambda/${aws_lambda_function.syncer.function_name}"
   retention_in_days = var.logging_retention_in_days
   kms_key_id        = var.logging_kms_key_id
+  log_group_class   = var.log_class
   tags              = var.tags
 }
 
diff --git a/modules/runner-binaries-syncer/variables.tf b/modules/runner-binaries-syncer/variables.tf
@@ -134,6 +134,17 @@ variable "logging_kms_key_id" {
   default     = null
 }
 
+variable "log_class" {
+  description = "The log class of the CloudWatch log group. Valid values are `STANDARD` or `INFREQUENT_ACCESS`."
+  type        = string
+  default     = "STANDARD"
+
+  validation {
+    condition     = contains(["STANDARD", "INFREQUENT_ACCESS"], var.log_class)
+    error_message = "`log_class` must be either `STANDARD` or `INFREQUENT_ACCESS`."
+  }
+}
+
 variable "lambda_s3_bucket" {
   description = "S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly."
   type        = string
diff --git a/modules/runners/pool.tf b/modules/runners/pool.tf
@@ -22,6 +22,7 @@ module "pool" {
       log_level                      = var.log_level
       logging_retention_in_days      = var.logging_retention_in_days
       logging_kms_key_id             = var.logging_kms_key_id
+      log_class                      = var.log_class
       reserved_concurrent_executions = var.pool_lambda_reserved_concurrent_executions
       s3_bucket                      = var.lambda_s3_bucket
       s3_key                         = var.runners_lambda_s3_key
diff --git a/modules/runners/pool/main.tf b/modules/runners/pool/main.tf
@@ -72,6 +72,7 @@ resource "aws_cloudwatch_log_group" "pool" {
   name              = "/aws/lambda/${aws_lambda_function.pool.function_name}"
   retention_in_days = var.config.lambda.logging_retention_in_days
   kms_key_id        = var.config.lambda.logging_kms_key_id
+  log_group_class   = var.config.lambda.log_class
   tags              = var.config.tags
 }
 
diff --git a/modules/runners/pool/variables.tf b/modules/runners/pool/variables.tf
@@ -5,6 +5,7 @@ variable "config" {
       log_level                      = string
       logging_retention_in_days      = number
       logging_kms_key_id             = string
+      log_class                      = string
       reserved_concurrent_executions = number
       s3_bucket                      = string
       s3_key                         = string
diff --git a/modules/runners/scale-down.tf b/modules/runners/scale-down.tf
@@ -62,6 +62,7 @@ resource "aws_cloudwatch_log_group" "scale_down" {
   name              = "/aws/lambda/${aws_lambda_function.scale_down.function_name}"
   retention_in_days = var.logging_retention_in_days
   kms_key_id        = var.logging_kms_key_id
+  log_group_class   = var.log_class
   tags              = var.tags
 }
 
diff --git a/modules/runners/scale-up.tf b/modules/runners/scale-up.tf
@@ -85,6 +85,7 @@ resource "aws_cloudwatch_log_group" "scale_up" {
   name              = "/aws/lambda/${aws_lambda_function.scale_up.function_name}"
   retention_in_days = var.logging_retention_in_days
   kms_key_id        = var.logging_kms_key_id
+  log_group_class   = var.log_class
   tags              = var.tags
 }
 
diff --git a/modules/runners/ssm-housekeeper.tf b/modules/runners/ssm-housekeeper.tf
@@ -59,6 +59,7 @@ resource "aws_cloudwatch_log_group" "ssm_housekeeper" {
   name              = "/aws/lambda/${aws_lambda_function.ssm_housekeeper.function_name}"
   retention_in_days = var.logging_retention_in_days
   kms_key_id        = var.logging_kms_key_id
+  log_group_class   = var.log_class
   tags              = var.tags
 }
 
diff --git a/modules/runners/variables.tf b/modules/runners/variables.tf
@@ -335,6 +335,17 @@ variable "logging_kms_key_id" {
   default     = null
 }
 
+variable "log_class" {
+  description = "The log class of the CloudWatch log groups for the lambda functions. Valid values are `STANDARD` or `INFREQUENT_ACCESS`."
+  type        = string
+  default     = "STANDARD"
+
+  validation {
+    condition     = contains(["STANDARD", "INFREQUENT_ACCESS"], var.log_class)
+    error_message = "`log_class` must be either `STANDARD` or `INFREQUENT_ACCESS`."
+  }
+}
+
 variable "enable_ssm_on_runners" {
   description = "Enable to allow access to the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances."
   type        = bool
diff --git a/modules/termination-watcher/variables.tf b/modules/termination-watcher/variables.tf
@@ -9,6 +9,7 @@ variable "config" {
     `lambda_principals`: Add extra principals to the role created for execution of the lambda, e.g. for local testing.
     `lambda_tags`: Map of tags that will be added to created resources. By default resources will be tagged with name and environment.
     `log_level`: Logging level for lambda logging. Valid values are  'silly', 'trace', 'debug', 'info', 'warn', 'error', 'fatal'.
+    `log_class`: The log class of the CloudWatch log group. Valid values are `STANDARD` or `INFREQUENT_ACCESS`.
     `logging_kms_key_id`: Specifies the kms key id to encrypt the logs with
     `logging_retention_in_days`: Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653.
     `memory_size`: Memory size limit in MB of the lambda.
@@ -37,6 +38,7 @@ variable "config" {
     }), {})
     lambda_tags               = optional(map(string), {})
     log_level                 = optional(string, null)
+    log_class                 = optional(string, "STANDARD")
     logging_kms_key_id        = optional(string, null)
     logging_retention_in_days = optional(number, null)
     memory_size               = optional(number, null)
diff --git a/modules/webhook/direct/variables.tf b/modules/webhook/direct/variables.tf
@@ -18,6 +18,7 @@ variable "config" {
     role_path                 = optional(string, null)
     logging_retention_in_days = optional(number, 180)
     logging_kms_key_id        = optional(string, null)
+    log_class                 = optional(string, "STANDARD")
     lambda_s3_bucket          = optional(string, null)
     lambda_s3_key             = optional(string, null)
     lambda_s3_object_version  = optional(string, null)
diff --git a/modules/webhook/direct/webhook.tf b/modules/webhook/direct/webhook.tf
@@ -58,6 +58,7 @@ resource "aws_cloudwatch_log_group" "webhook" {
   name              = "/aws/lambda/${aws_lambda_function.webhook.function_name}"
   retention_in_days = var.config.logging_retention_in_days
   kms_key_id        = var.config.logging_kms_key_id
+  log_group_class   = var.config.log_class
   tags              = var.config.tags
 }
 
diff --git a/modules/webhook/eventbridge/dispatcher.tf b/modules/webhook/eventbridge/dispatcher.tf
@@ -73,6 +73,7 @@ resource "aws_cloudwatch_log_group" "dispatcher" {
   name              = "/aws/lambda/${aws_lambda_function.dispatcher.function_name}"
   retention_in_days = var.config.logging_retention_in_days
   kms_key_id        = var.config.logging_kms_key_id
+  log_group_class   = var.config.log_class
   tags              = var.config.tags
 }
 
diff --git a/modules/webhook/eventbridge/variables.tf b/modules/webhook/eventbridge/variables.tf
@@ -18,6 +18,7 @@ variable "config" {
     role_path                 = optional(string, null)
     logging_retention_in_days = optional(number, 180)
     logging_kms_key_id        = optional(string, null)
+    log_class                 = optional(string, "STANDARD")
     lambda_s3_bucket          = optional(string, null)
     lambda_s3_key             = optional(string, null)
     lambda_s3_object_version  = optional(string, null)
diff --git a/modules/webhook/eventbridge/webhook.tf b/modules/webhook/eventbridge/webhook.tf
@@ -62,6 +62,7 @@ resource "aws_cloudwatch_log_group" "webhook" {
   name              = "/aws/lambda/${aws_lambda_function.webhook.function_name}"
   retention_in_days = var.config.logging_retention_in_days
   kms_key_id        = var.config.logging_kms_key_id
+  log_group_class   = var.config.log_class
   tags              = var.config.tags
 }
 
diff --git a/modules/webhook/variables.tf b/modules/webhook/variables.tf
@@ -81,6 +81,17 @@ variable "logging_kms_key_id" {
   default     = null
 }
 
+variable "log_class" {
+  description = "The log class of the CloudWatch log group. Valid values are `STANDARD` or `INFREQUENT_ACCESS`."
+  type        = string
+  default     = "STANDARD"
+
+  validation {
+    condition     = contains(["STANDARD", "INFREQUENT_ACCESS"], var.log_class)
+    error_message = "`log_class` must be either `STANDARD` or `INFREQUENT_ACCESS`."
+  }
+}
+
 variable "lambda_s3_bucket" {
   description = "S3 bucket from which to specify lambda functions. This is an alternative to providing local files directly."
   type        = string
diff --git a/modules/webhook/webhook.tf b/modules/webhook/webhook.tf
@@ -64,6 +64,7 @@ module "direct" {
     role_path                             = local.role_path,
     logging_retention_in_days             = var.logging_retention_in_days,
     logging_kms_key_id                    = var.logging_kms_key_id,
+    log_class                             = var.log_class,
     lambda_s3_bucket                      = var.lambda_s3_bucket,
     lambda_s3_key                         = var.webhook_lambda_s3_key,
     lambda_s3_object_version              = var.webhook_lambda_s3_object_version,
@@ -105,6 +106,7 @@ module "eventbridge" {
     role_path                             = local.role_path,
     logging_retention_in_days             = var.logging_retention_in_days,
     logging_kms_key_id                    = var.logging_kms_key_id,
+    log_class                             = var.log_class,
     lambda_s3_bucket                      = var.lambda_s3_bucket,
     lambda_s3_key                         = var.webhook_lambda_s3_key,
     lambda_s3_object_version              = var.webhook_lambda_s3_object_version,
diff --git a/variables.tf b/variables.tf
@@ -370,6 +370,17 @@ variable "logging_kms_key_id" {
   default     = null
 }
 
+variable "log_class" {
+  description = "The log class of the CloudWatch log groups. Valid values are `STANDARD` or `INFREQUENT_ACCESS`."
+  type        = string
+  default     = "STANDARD"
+
+  validation {
+    condition     = contains(["STANDARD", "INFREQUENT_ACCESS"], var.log_class)
+    error_message = "`log_class` must be either `STANDARD` or `INFREQUENT_ACCESS`."
+  }
+}
+
 variable "block_device_mappings" {
   description = "The EC2 instance block device configuration. Takes the following keys: `device_name`, `delete_on_termination`, `volume_type`, `volume_size`, `encrypted`, `iops`, `throughput`, `kms_key_id`, `snapshot_id`."
   type = list(object({

Original file line number	Diff line number	Diff line change
`@@ -51,6 +51,7 @@ resource "aws_cloudwatch_log_group" "ami_housekeeper" {`
`51`	`51`	`name = "/aws/lambda/${aws_lambda_function.ami_housekeeper.function_name}"`
`52`	`52`	`retention_in_days = var.logging_retention_in_days`
`53`	`53`	`kms_key_id = var.logging_kms_key_id`
	`54`	`+ log_group_class = var.log_class`
`54`	`55`	`tags = var.tags`
`55`	`56`	`}`
`56`	`57`
Original file line number	Diff line number	Diff line change
`@@ -56,6 +56,7 @@ resource "aws_cloudwatch_log_group" "main" {`
`56`	`56`	`name = "/aws/lambda/${aws_lambda_function.main.function_name}"`
`57`	`57`	`retention_in_days = var.lambda.logging_retention_in_days`
`58`	`58`	`kms_key_id = var.lambda.logging_kms_key_id`
	`59`	`+ log_group_class = var.lambda.log_class`
`59`	`60`	`tags = var.lambda.tags`
`60`	`61`	`}`
`61`	`62`