Question

A company operates 40 AWS accounts within an AWS Organization. The platform team wants a single monitoring account where engineers can query CloudWatch metrics, logs, and X-Ray traces from all member accounts through unified dashboards, without having to switch roles or log into each source account individually. The solution must scale automatically as new member accounts are added and require minimal per-account configuration. What is the MOST operationally efficient approach?

Accepted Answer

Enable CloudWatch cross-account observability by designating the platform account as the monitoring account and linking source accounts (or an entire OU) as source accounts, sharing metrics, logs, and traces.

Answer

Create a CloudWatch metric stream and Kinesis Data Firehose in each account to forward all metrics and logs to a centralized S3 bucket, then query them with Athena.

Answer

Configure a CloudWatch Logs subscription filter in every account to stream logs to a central Kinesis stream, and use cross-account IAM roles that engineers assume to view metrics and traces.

Answer

Build a Lambda function in the monitoring account that periodically assumes a role in each member account, calls GetMetricData and FilterLogEvents, and stores the results in a shared DynamoDB table for dashboarding.