Skip to content
cwsweep

Getting started

Installation

Section titled “Installation”

Download the binary for your platform (Linux / macOS, x86_64 / arm64) from GitHub Releases.

To build from source, install the Rust toolchain and run:

Terminal window
cargo install --git https://github.com/hideokamoto/cwsweep --locked

Prerequisites

Section titled “Prerequisites”
  • Run cwsweep with the credentials of the AWS Organizations management account. cwsweep does not assume a role into the management account itself; it uses your current credentials as is.
  • cwsweep assumes a role into each member account. The default role name is OrganizationAccountAccessRole, which you can override with --role-name.
  • Only the AWS standard partition (aws, commercial regions) is supported. See Scope for details.

Your first scan

Section titled “Your first scan”

Start with the read-only scan subcommand. scan prints log groups as a table and exits; it has no code path that can reach deletion or retention changes.

Terminal window
cwsweep scan --regions us-east-1,us-west-2

Subcommands

Section titled “Subcommands”
Subcommand Purpose Writes to AWS
scan Inventory (display only) No
clean Interactively select log groups to delete or change retention Only with --execute
retention set Set the same retention period on all log groups Only with --execute (never deletes)
audit View the audit log No (does not connect to AWS)

Invoking cwsweep without a subcommand is an error.