Skip to content
cwsweep

clean — Select, delete, and change retention

clean proceeds through scan → interactive selection → confirmation. Dry-run is the default: nothing is deleted and no retention is changed unless you explicitly pass --execute.

Terminal window
# Dry-run (default). Goes through scan → interactive selection → confirmation, but never deletes or changes retention
cwsweep clean --regions us-east-1


# Actually delete / change retention (this never happens unless you pass this flag explicitly)
cwsweep clean --regions us-east-1 --execute


# Override the audit log destination (default: cwsweep-audit.jsonl in the current directory.
# There is no option to disable it)
cwsweep clean --regions us-east-1 --audit-log-path /var/log/cwsweep/audit.jsonl
  • The interactive multi-select always starts with every item unchecked.
  • Before execution, a confirmation screen restates the target account IDs, regions, log group names, and total bytes.
  • When stdin is not a TTY (pipes, CI, etc.), clean prints the scan results, warns that it cannot proceed to interactive selection, and exits successfully. Use scan for inventories in non-interactive environments.

See Safety for the full set of safety mechanisms.