Inventory the whole Organization
Starting from the management account’s credentials, cwsweep assumes a role into every member account and aggregates log groups in the regions you specify.
cwsweep
A Rust CLI that inventories CloudWatch Logs across an entire AWS Organization and safely deletes or changes the retention of interactively selected log groups.
Dry-run by default
Unless you explicitly pass --execute, delete-log-group and put-retention-policy are never called.
Double identity verification
The account ID is verified with sts:get-caller-identity twice: at scan time and again right before execution.
Audit log is always written
Every deletion and retention change is recorded in a JSON Lines audit log, and any operation whose log entry cannot be written is aborted.