A better CloudWatch Logs console, in your own AWS account.
Cloud Certainty TraceHound shows what every log group stores, ingests and costs across your AWS accounts and Regions, finds the ones that never expire or that nothing writes to any more, and fixes their retention in bulk. Your engineers search, trace one request through every service, and watch Live Tail together, while you decide who may read which log groups and AWS enforces it. It runs entirely in your AWS account, and nothing leaves it.
ONE CLOUDFORMATION STACK · YOUR ACCOUNT · YOUR IDP · EARLY ACCESS · PLANNED FROM $100 A MONTH
Not on AWS Marketplace yet. Early access by email: [email protected].
[ A ] WHAT THE CLOUDWATCH CONSOLE LEAVES TO YOU, AND WHAT TRACEHOUND ADDS
The CloudWatch Logs console runs a query and shows the events. Teams with thousands of log groups end up with spreadsheets of what each one costs, retention scripts, links pasted into chat, a Live Tail session per person, and IAM policies written team by team. TraceHound covers the gaps and keeps everything in your account.
Cost per log group
The CloudWatch console:A stored bytes figure for each log group, with no history of it. Nothing says what a log group costs to ingest and keep, or how fast it grows.
TraceHound:Every log group’s stored bytes, growth over 7 and 30 days, ingestion and estimated monthly cost in one table across accounts and Regions, grouped by resource, prefix or tag, with a daily history of storage and ingestion kept from 90 days to five years.
Retention and hygiene
The CloudWatch console:New log groups never expire unless something sets a retention, and retention is changed one log group at a time. Log groups of deleted Lambda functions stay, and so does their bill.
TraceHound:Recommendations for never-expire, orphaned Lambda, stale, fast-growing and noisy log groups, each with its saving, a retention what-if, and retention set on hundreds of log groups at once on Team and above.
Who ran what
The CloudWatch console:Recent queries with no name beside them. What the team’s queries cost shows up only on the monthly bill.
TraceHound:Every query run through TraceHound with who ran it, the bytes scanned and its estimated cost, kept from 30 days to two years. Administrators see daily totals, and on Business and above usage and cost per person and Region and a daily scan budget per user.
Following a request
The CloudWatch console:One request crosses API Gateway, a few Lambda functions and a container. Finding it means choosing every log group by hand and reading one long list.
TraceHound:Trace: paste a request id, trace id or order number, and TraceHound searches every log group you pick, in batches of 50, and draws a timeline with one lane per service, the next identifiers to follow and a link to the X-Ray trace.
Live Tail
The CloudWatch console:Each person watching starts their own Live Tail session, billed per minute.
TraceHound:One Live Tail session for everyone watching the same log groups and filter, up to 10 log groups, stopped within a minute of the last viewer leaving, with an optional daily limit of minutes per person.
Sharing
The CloudWatch console:Saved queries live in one account and Region, with no versions, and a link to a result works only for people with console access to that account.
TraceHound:Saved queries and dashboards with folders, tags, variables and every version kept, a permalink for every search, and expiring snapshots of a result or a dashboard. Shared with the team on Team and above.
Dashboards
The CloudWatch console:Dashboards are built widget by widget, account by account.
TraceHound:Dashboards from Logs Insights queries, with variables, a time picker, auto-refresh and a log list panel, started from a template gallery: Lambda, API Gateway, VPC Flow Logs, CloudTrail, application logs and containers.
Access
The CloudWatch console:Each team needs IAM policies scoped to its log groups, plus console access, written and kept up to date by hand.
TraceHound:Grants per user or group: browse, read, export or manage on log group patterns such as “/aws/lambda/payments-*”, per account and Region. AWS enforces them through a session policy on every request, so a log group outside the grant is refused even inside a query over many.
Audit
The CloudWatch console:CloudTrail shows the IAM role behind a query, not the person.
TraceHound:The user’s email is the source identity of every AWS session, so CloudTrail names the person on every CloudWatch Logs call TraceHound makes. The audit log records administrative changes, retention changes, exports and snapshots.
Many accounts
The CloudWatch console:Sign in to each account and switch Region to see its log groups.
TraceHound:One inventory, search, Trace and Live Tail across your AWS accounts and Regions, through a small role in each account, deployed one by one or across an AWS Organization with a StackSet.
[ B ] STORAGE AND COST, PER LOG GROUP
See what every log group costs and how fast it grows, find the ones nobody needs, and set their retention in one step. Estimates use the prices in Settings, so they match your Region.
- Overview
- Log groups, stored bytes, ingestion over the last 30 days and estimated monthly cost over every account and Region you can see, the top growers, and the never-expire and orphaned counts with what they cost.
- Inventory
- Class, stored bytes, growth over 7 and 30 days, ingestion over 1, 7 and 30 days, retention, KMS key, data and deletion protection, the resource that writes there and its owner tag. Grouped by resource type, prefix or tag, filtered, and exported as CSV.
- History
- A collector in your account records every log group’s stored bytes and ingestion each day, with 90 days of ingestion read back on the first run, so growth is a chart, not a guess.
- Recommendations
- Never-expire, orphaned Lambda, stale, fast-growing and noisy log groups, Infrequent Access candidates, and groups without a KMS key or deletion protection, each with the saving.
- Retention
- A what-if that shows the saving of a retention before you set it, then the change on one log group or hundreds at once. Team and above, for people with the manage grant.
- Log group page
- Storage and ingestion charts, settings, tags, metric and subscription filters, anomaly detectors, related resources with links to the AWS console, and the latest events, read for free.
- Log group /aws/lambda/orders-api
- Class Standard
- Retention Never expire
- Stored 1.84 TB
- Growth, 30 days +160 GB
- Storage cost $55.20 a month
[ C ] EXPLORE AND TRACE
Search the way you would in a log tool, not a query language, across as many log groups as you are granted. When one request went wrong, Trace follows its id through every service it touched.
- Search
- Words, exclusions, field:value, @field:>number, OR groups and exact phrases, or a full Logs Insights, PPL or SQL query with completion. Every search has a permalink.
- Histogram
- Events over time by level. Drag across it to zoom in.
- Events
- Level colours, a JSON tree, fields as columns, and the events around any event in its stream.
- Facets
- Field values counted at once over the events on screen, or over every match in the time range.
- Patterns
- Similar messages grouped into patterns with their counts, compared with the previous period to show what is new.
- Visualise
- A stats query as a chart, added to a dashboard in one step. Each run shows the bytes it scanned and its cost.
level:ERROR timeout -healthcheck
@duration:>500 service:(orders OR payments)- API-Gateway-Execution-Logs_k3x9/prod
- /aws/lambda/orders-api
- /aws/lambda/payments
- /ecs/fulfilment
[ D ] LIVE TAIL AND DASHBOARDS
Live Tail, shared
During an incident, everyone watches the same stream. Viewers of the same log groups and filter share one Live Tail session, so ten people cost what one does, and it stops within a minute of the last one leaving.
- One Live Tail session per set of log groups and filter, however many people watch it
- Up to 10 log groups, with a filter pattern, highlight, pause, level colours and JSON
- The event rate, and a notice when CloudWatch samples above 500 events a second
- Minutes used shown as you go, and an optional daily limit per person
Dashboards from a template gallery
Every panel is a Logs Insights query with a chart, a table or a log list, under one time range and a row of variables, including one that picks log groups. Start from a template and pick your log groups:
- LambdaFunction logs
- API GatewayAccess logs
- VPC Flow LogsNetwork traffic
- CloudTrailAPI activity
- Application logsStructured JSON
- ContainersECS and EKS
Panels run with the permissions of the person viewing the dashboard, reuse recent results so a refresh costs little, and refresh down to 5 minutes on Starter and 10 seconds on Enterprise.
[ E ] TEAMS AND GOVERNANCE
Grants on log group patterns
Give users and groups from your identity provider browse, read, export or manage on patterns such as /aws/lambda/payments-*, per connection and Region. Users see no log group until they are granted one.
Enforced by AWS
The API checks every grant, and every AWS call runs with credentials a session policy limits to the granted log groups. A grant that would not fit is refused, never widened.
Named in CloudTrail
The user’s email is the SourceIdentity of every AWS session TraceHound starts, so CloudTrail in each account names the person behind every query, search and tail.
History and cost per person
Who ran which query, what it scanned and what it cost, with daily totals for administrators, and on Business and above usage and cost per user and Region, Live Tail minutes included.
Budgets
A daily data scanned budget per user on Business and above, refused before the query starts, and a daily Live Tail minute limit on every plan.
Audit and sign-in
An audit log of roles, connections, grants, settings, retention changes, exports and snapshots. Sign-in through IAM Identity Center or Cognito on every plan, and your own SAML or OIDC provider on Team and above.
[ F ] SECURITY
Nothing leaves your account
Your logs stay in CloudWatch Logs and are read with your account’s own APIs when you look at them. Cloud Certainty runs no service in the data path, and TraceHound sends no telemetry. The one outbound request is an optional daily read of a public release manifest.
Least privilege, twice
Users see no log group until they are granted one. The API checks the grant, then AWS enforces it again through a per-request session policy on the log group ARNs.
Masked data stays masked
TraceHound’s roles never get logs:Unmask, so data a CloudWatch Logs data protection policy masks stays masked for everyone, administrators included.
Results stay private
A query’s results are shown to the person who ran it and to administrators. Exports need the export permission, and they and snapshots are audited.
Audit
CloudTrail names the person on every AWS call TraceHound makes, and the audit log keeps administrative changes, retention changes, exports and snapshots for 30 days to 10 years by plan.
The security overview has the threat model, the IAM roles, the data flows and the shared responsibility a security review needs.
[ G ] RUNS IN YOUR ACCOUNT, FROM LAUNCH TO THE FIRST TRACE
- 01
Deploy
Launch one CloudFormation stack in your own account and Region. It is serverless, so it costs close to nothing while nobody is looking at logs.
Stays in your account
Saved queries, dashboards, history, storage figures, snapshots and the audit log are in DynamoDB in your account. Nothing is sent to Cloud Certainty.
Licensed through AWS
The licence is read from AWS License Manager in your own account. Nothing phones home.
- 02
Sign in
Users sign in through Amazon Cognito with MFA or AWS IAM Identity Center on every plan, or your own SAML or OIDC provider, such as Microsoft Entra ID or Okta, on Team and above.
Only trusted identities
Roles and grants follow the user’s email, so TraceHound accepts only emails your directory asserts or has verified.
- 03
Connect accounts
Log groups in this account are there from the start. Reach other accounts through a small IAM role you deploy in each, at the access level you choose.
The role is the ceiling
With the Read level, TraceHound can list and read logs, nothing more. Changing retention needs the Manage level, the Team plan and a manage grant.
- 04
Grant and explore
Give teams access to their log groups. They search, trace, tail and build dashboards without AWS console access, and you see what each log group costs.
Scoped on every request
Each AWS call runs with short-lived credentials narrowed by a session policy to the user’s grants.
Every query traced
The user’s email is the source identity of every session, so CloudTrail names the person.
One serverless stack: an API on API Gateway and Lambda, a Live Tail function, a daily storage collector, the web app on Amplify Hosting, Amazon Cognito sign-in and DynamoDB tables. The installation guide lists every parameter.
[ H ] PLANS AND PRICING
The pricing planned for the AWS Marketplace launch: contract pricing, monthly or 12 months up front. Plans are not priced per user, per log group or per gigabyte: everyone in your organisation can use TraceHound. Prices in US dollars, billed through your AWS bill.
Starter
For a small team that wants to see what its logs cost, search and trace them, and keep private queries and dashboards.
- AWS accounts
- 3
- Storage history kept
- 90 days
- Query history kept
- 30 days
- Saved queries per user
- 50
- Dashboards per user
- 5
Team
Adds retention changes from TraceHound, shared queries and dashboards, snapshots, and your own SAML or OIDC sign-in.
- AWS accounts
- 10
- Storage history kept
- 365 days
- Query history kept
- 90 days
- Saved queries per user
- 500
- Dashboards per user
- 50
Business
Adds cost control and governance: daily scan budgets per user, usage and cost per user and Region, and the IP allowlist.
- AWS accounts
- 50
- Storage history kept
- 730 days
- Query history kept
- 365 days
- Saved queries per user
- 2,000
- Dashboards per user
- 500
Enterprise
Everything in Business, with the highest limits and five years of storage history.
- AWS accounts
- Unlimited
- Storage history kept
- 1,825 days
- Query history kept
- 730 days
- Saved queries per user
- Unlimited
- Dashboards per user
- Unlimited
| Feature | Starter | Team | Business | Enterprise |
|---|---|---|---|---|
| Per month | $100 | $250 | $1,000 | $2,500 |
| 12 months | $1,000 | $2,500 | $10,000 | $25,000 |
| AWS accounts | 3 | 10 | 50 | Unlimited |
| Storage history kept | 90 days | 365 days | 730 days | 1,825 days |
| Query history kept | 30 days | 90 days | 365 days | 730 days |
| Saved queries per user | 50 | 500 | 2,000 | Unlimited |
| Dashboards per user | 5 | 50 | 500 | Unlimited |
| Versions kept per query or dashboard | 5 | 25 | 50 | 100 |
| Audit log kept | 30 days | 90 days | 365 days | 3,650 days |
| Fastest dashboard refresh | 5 minutes | 1 minute | 30 seconds | 10 seconds |
| Rows per snapshot | No snapshots | 10,000 | 50,000 | 100,000 |
| Retention changes from TraceHound, one log group or hundreds at a time | Not included | Included | Included | Included |
| Shared saved queries and dashboards | Not included | Included | Included | Included |
| Snapshots of results and dashboards, with an expiry | Not included | Included | Included | Included |
| SAML and OIDC identity providers, such as Microsoft Entra ID and Okta | Not included | Included | Included | Included |
| IP allowlist on every API call | Not included | Not included | Included | Included |
| Daily data scanned budgets per user | Not included | Not included | Included | Included |
| Usage and cost per user and per Region, Live Tail minutes included | Not included | Not included | Included | Included |
Every plan includes
- Overview and log group inventory across accounts and Regions: class, stored bytes, growth, ingestion, retention and estimated monthly cost
- Storage and ingestion history per log group, collected every day in your account
- Recommendations: never-expire, orphaned Lambda, stale, fast-growing and noisy log groups, with the savings
- Explore: search syntax or full Logs Insights, PPL and SQL, with a histogram, facets, patterns, JSON and context
- Trace: one value followed across any number of log groups on a timeline
- Live Tail shared between viewers, up to 10 log groups per session
- Private saved queries and dashboards with versions, a template gallery, variables and auto-refresh
- Bytes scanned and estimated cost of every query, and a history of who ran what
- Grants per user or group on log group patterns, enforced by AWS session policies, with the user’s email in CloudTrail
- Connections to other AWS accounts, daily usage totals and an audit log
- Amazon Cognito sign-in with MFA, and IAM Identity Center
Pricing for the launch
TraceHound is in early access and not on AWS Marketplace yet. These are the plans and prices planned for the launch. Until then, ask for early access.
Business and Enterprise are add-ons
On the TraceHound listing, Team is the base plan. Business is Team plus the Business add-on ($750 a month or $7,500 for 12 months), and Enterprise adds the Enterprise add-on to both ($1,500 a month or $15,000 for 12 months). An add-on on its own grants nothing. Starter is a separate listing, TraceHound Starter.
CloudWatch is billed by AWS
Your logs, Logs Insights queries and Live Tail minutes are billed by CloudWatch as usual, exactly as in the console. TraceHound shows the cost of every query, shares Live Tail sessions, finds the log groups that cost the most to keep, and on Business and above caps each person’s daily scan. Lambda, API Gateway, DynamoDB and Cognito cost pennies a month for a team.
Support
Basic support is included. Paid plans with response times, and a fixed-price installation service, are on the support page. Questions about plans: [email protected].
[ I ] QUESTIONS
- Can I use TraceHound today?
- It is in early access. It is not on AWS Marketplace yet; email us about your AWS setup and we will set you up ahead of the launch.
- Does any data leave my AWS account?
- No. The stack runs in your account and calls AWS only. Everything TraceHound stores is in DynamoDB in your account, and the licence is read from AWS License Manager there.
- Does it copy my logs?
- No. Events are read from CloudWatch Logs when you look at them. TraceHound keeps the query history, saved queries, dashboards, the daily storage figures of each log group, and the snapshots someone creates on purpose.
- Can it change my logs?
- It never writes or deletes log events. The one change it can make is a log group’s retention, on Team and above, for people with a manage grant on a connection whose role has the Manage level, and each change is audited.
- What does it cost to run?
- The licence is a monthly or 12-month contract. CloudWatch bills your Logs Insights queries and Live Tail minutes as usual; TraceHound shows that cost, shares Live Tail sessions and reuses recent results to keep it down. The daily storage collector costs about $0.04 a day for a Region with 2,000 log groups, and Lambda, API Gateway, DynamoDB and Cognito cost pennies a month for a team.
- Why not just the CloudWatch console?
- Every TraceHound query runs in CloudWatch Logs, so you keep what AWS adds to it. What TraceHound adds is around it: what each log group costs and how it grows, retention across thousands of log groups, Trace across services, shared Live Tail, shared queries and dashboards, and least-privilege grants, in one place across your accounts.
More in the FAQ, and the documentation.
Amazon Web Services, AWS, Amazon CloudWatch, AWS CloudTrail, AWS Lambda, AWS X-Ray and AWS Marketplace are trademarks of Amazon.com, Inc. or its affiliates. TraceHound is a product of Cloud Certainty OÜ and is not affiliated with or endorsed by Amazon.