Question

A DevOps team operates a microservices platform where each service runs in a separate AWS account and ships application logs to a CloudWatch Logs log group in its own account. During a recent incident, engineers needed to correlate 5xx error patterns across all services but had to log in to each account individually and run separate queries, which delayed the investigation. The team wants to enable engineers in a central operations account to run a single CloudWatch Logs Insights query spanning log groups in all the service accounts, with the least ongoing operational overhead. Which approach should they implement?

Accepted Answer

Configure CloudWatch cross-account observability by designating the operations account as the monitoring account and linking each service account as a source account sharing logs, then run Logs Insights queries across the linked log groups.

Answer

Create a Kinesis Data Firehose subscription filter in each service account that streams all logs to a centralized S3 bucket, then use Athena to query the aggregated logs.

Answer

Set up a scheduled Lambda function in each account that runs Logs Insights queries locally and publishes the results to an SNS topic subscribed by the operations team.

Answer

Use a CloudWatch Logs subscription filter in each account to forward log events to a single log group in the operations account via a cross-account Kinesis Data Stream, then query that consolidated log group.