A university runs 30 AWS accounts for its research groups, teaching systems and administration. A central security operations team sits in a separate monitoring account, and it wants one set of dashboards and alarms that show metrics and logs from every account.
Each department owns its accounts and wants to keep control of its own resources. The central team must not receive IAM access into each account, and the dashboards must show near real-time data without copying metrics or logs into another store.
Which solution meets these requirements?
Choose one answer.
AA. In the monitoring account, create a cross-account observability sink and share it with the source accounts. Each source account links to it, and dashboards and alarms are built in the monitoring account.
BB. Create a metric stream in each source account that sends all metrics to an Amazon Data Firehose stream in the monitoring account, then store the metrics in Amazon S3 for Amazon Athena.
CC. Create an IAM role in each source account that the central team assumes from the monitoring account, then build the dashboards from the metrics that each role returns.
DD. Send CloudWatch alarm state changes from each source account to a central Amazon EventBridge bus, and have the monitoring account post the alerts to a shared chat channel.
Show the answer and explanation
Answer: A
A. Right: Correct. Cross-account observability lets the monitoring account view and alarm on metrics and logs from linked source accounts. Each department keeps its own resources and IAM, and no data is copied out of the source accounts. Learn more: Amazon CloudWatch cross-account observability (opens in a new tab)
B. Wrong: Metric streams work, but the metrics land in S3 and are queried with a delay, which is not the near real-time dashboard the team needs. The approach also copies metrics into a second store, which the requirements rule out.
C. Wrong: This gives the central team access into every department account, which the requirements rule out. Using a separate role per account also means many roles to manage, with no single set of dashboards.
D. Wrong: Forwarded alarm events give alerts but no dashboards of the underlying metrics or logs. The requirement is for one set of dashboards that show metrics and logs from every account.
Explanation
Cross-account observability links source accounts to a monitoring account, so one set of dashboards and alarms can show their metrics and logs. The departments keep their own resources and permissions, and the data is not copied. Metric streams add delay and copies, while roles and forwarded alarms each fail a stated requirement.
Want more on Security metrics, alarms and alert routing (CloudWatch, EventBridge)? The 5 full-length practice sets have 7 more Security metrics, alarms and alert routing (CloudWatch, EventBridge) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →