SOA-C03 practice question: CloudWatch metrics, alarms and dashboards (3 of 3)

Monitoring, Logging, Analysis, Remediation, and Performance Optimization A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

An esports league runs its match services in six AWS accounts across two AWS Regions. The operations lead wants one CloudWatch dashboard in a central monitoring account that shows metrics from all six accounts and both Regions side by side. Security policy forbids long-term access keys, and the team does not want to copy metric data into a separate store. Which TWO actions should a CloudOps engineer take? (Choose two.)

Choose two answers.

A. In the monitoring account, turn on the cross-account cross-Region option in the CloudWatch settings so that dashboard widgets can select other accounts and Regions.
B. Configure CloudWatch metric streams in every account and Region to deliver all metrics through Amazon Data Firehose into the monitoring account.
C. Create an IAM user in each source account with read-only CloudWatch permissions and store its access keys in the monitoring account's dashboard settings.
D. In each of the six source accounts, turn on sharing of CloudWatch data with the monitoring account, which creates a role that the monitoring account can assume.
E. Use AWS Resource Access Manager to share the CloudWatch dashboards and metric namespaces of each source account with the monitoring account.

Show the answer and explanation

Answers: A, D

A. Right: Correct. Turning this on in the monitoring account lets dashboard widgets and the metrics console choose an account and Region for each metric. Combined with sharing in the source accounts, one dashboard shows all of them. Learn more: Cross-account cross-Region CloudWatch console (opens in a new tab)
B. Wrong: Metric streams send metric data to a destination such as Firehose, which copies data into a separate store. That breaks the stated constraint and adds cost and setup in twelve places. Learn more: Use metric streams (opens in a new tab)
C. Wrong: Dashboards do not take stored access keys, and the policy forbids long-term keys anyway. Cross-account roles are the supported way to read metrics from other accounts. Learn more: Create IAM roles to use with the CloudWatch agent (opens in a new tab)
D. Right: Correct. Sharing CloudWatch data from a source account creates an IAM role that trusts the monitoring account. The dashboard reads metrics through that role, so no access keys are needed. Learn more: Cross-account cross-Region CloudWatch console (opens in a new tab)
E. Wrong: AWS RAM shares specific resource types such as subnets and Transit Gateways. It does not share CloudWatch dashboards or metric namespaces. Learn more: What is AWS Resource Access Manager? (opens in a new tab)

Explanation

CloudWatch supports cross-account, cross-Region dashboards without moving data. The monitoring account turns on the cross-account cross-Region view, and each source account shares its CloudWatch data, which creates a role the monitoring account assumes. Access keys, metric streams and AWS RAM either break the constraints or do not apply.

Study

Cross-account cross-Region CloudWatch console

SOA-C03 practice question: CloudWatch metrics, alarms and dashboards (3 of 3)

Explanation

Study

Keep practicing