How to fix Error creating CloudWatch Log Group: ResourceAlreadyExistsException in Terraform

Check if the log group actually exists in your AWS account:

aws logs describe-log-groups --log-group-name-prefix "/aws/lambda/" --query 'logGroups[?logGroupName==`/aws/lambda/your-function-name`]'

Or use the AWS Console: CloudWatch > Logs > Log Groups and search for your log group name.

If it exists, you'll need to import it into Terraform state or remove it from your configuration.

The recommended solution is to import the existing log group into your Terraform state without destroying it:

terraform import aws_cloudwatch_log_group.example /aws/lambda/my-function-name

The import path is the exact log group name. For Lambda functions, this is typically /aws/lambda/<function-name>.

After importing successfully, your terraform plan should show no changes and subsequent terraform apply runs will work correctly.

If using Lambda, create the CloudWatch Log Group before the Lambda function and explicitly declare a dependency:

resource "aws_cloudwatch_log_group" "lambda_logs" {
  name              = "/aws/lambda/my-function"
  retention_in_days = 14
}

resource "aws_lambda_function" "example" {
  function_name = "my-function"
  # ... other configuration ...

  depends_on = [aws_cloudwatch_log_group.lambda_logs]
}

This ensures Terraform creates the log group before Lambda, preventing AWS from auto-creating it and causing conflicts.

If the log group contains sensitive data you don't want to keep, or if you prefer a fresh start:

aws logs delete-log-group --log-group-name "/aws/lambda/my-function-name"

WARNING: This permanently deletes all logs in that group. Only use if you're certain you don't need the logs.

After deletion, run:

terraform apply

Terraform will now successfully create the log group.

If other AWS services auto-create log groups (ECS, API Gateway, etc.), you can configure Terraform to skip deletion:

resource "aws_cloudwatch_log_group" "api_gateway" {
  name              = "/aws/apigateway/my-api"
  retention_in_days = 7
  skip_destroy      = true  # Don't delete on terraform destroy
}

This prevents Terraform from deleting log groups that might be recreated by the service. However, the log group must still be imported first.