Question

A company runs 40 workload accounts under AWS Organizations. The central operations team must build unified dashboards and alarms that correlate CloudWatch metrics and logs from all workload accounts without deploying and maintaining custom agents or Lambda functions to copy data between accounts. They also want to minimize ongoing operational overhead. Which approach best meets these requirements?

Accepted Answer

Configure CloudWatch cross-account observability by designating the operations account as the monitoring account and linking the 40 workload accounts as source accounts, then build dashboards and alarms in the monitoring account.

Answer

Enable CloudWatch metric streams in each workload account to push metrics to a central Kinesis Data Firehose, then store data in S3 and query with Athena for dashboards.

Answer

Create a scheduled Lambda function in each workload account that uses GetMetricData to export metrics to the operations account via a cross-account IAM role, then aggregate in a central CloudWatch dashboard.

Answer

Deploy the CloudWatch agent in every workload account configured to write metrics and logs directly to log groups in the operations account using cross-account credentials.