Multi-account log aggregation and alerting: SAP-C03 study notes and practice questions
What to know about Multi-account log aggregation and alerting for the SAP-C03 exam, from the Operational Excellence and Automation domain (20% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
SAP-C03 asks how to get logs and metrics from hundreds of accounts into one place for search, security analysis and long-term retention, and how to alert the right people without noise.
Getting logs into a central account
Method
How it works
Fits
Cross-account subscription
Source log groups use a subscription filter to a CloudWatch Logs destination in the central account, which points to Kinesis Data Streams or Firehose; a destination policy allows the source accounts or organization
Real-time streaming to analytics, SIEM or S3
Account-level subscription policy
One subscription filter policy covers every log group in an account, including new ones
No per-log-group setup
CloudWatch Logs centralization
Organization rules copy log groups from member accounts and Regions into a central account
Central search with CloudWatch Logs Insights
Cross-account observability
Source accounts link to a monitoring account with Observability Access Manager; logs, metrics and traces stay in place but can be queried centrally
Dashboards and investigation across accounts
The log group and its destination must be in the same Region; the Kinesis or Firehose stream behind the destination can be elsewhere.
Organization CloudTrail trails deliver API activity from every account to one S3 bucket in the log archive account; VPC Flow Logs can publish straight to a central bucket.
Archiving
Firehose to S3 with compression and partitioning, then S3 Lifecycle to S3 Glacier Instant Retrieval, Flexible Retrieval or Deep Archive as access drops.
S3 Object Lock and a restrictive bucket policy protect audit logs from deletion.
Set CloudWatch Logs retention on every log group (the default is never expire) and use the Infrequent Access log class for logs you rarely query.
Query archives in place with Athena.
Alerting
CloudWatch alarms on metrics, metric math, anomaly detection bands or Metrics Insights queries; composite alarms combine conditions to cut noise and can suppress actions during maintenance.
Metric filters turn log patterns into metrics you can alarm on.
Alarm actions: SNS (email, SMS, HTTPS, Lambda, chat through Amazon Q Developer in chat applications), Auto Scaling, EC2 actions, and Systems Manager OpsItems.
Alarm state changes are EventBridge events, so a rule can start an Automation runbook.
How to choose
Scenario wording
Choose
“Stream all application logs from every account to a SIEM in near real time”
Account-level subscription policies to a cross-account destination with Kinesis or Firehose
“Search logs from all accounts in one Logs Insights query”
CloudWatch Logs centralization or cross-account observability
“Keep logs 7 years at lowest cost”
Firehose to S3, Lifecycle to Glacier Deep Archive
“Page only when latency and errors are both high”
Composite alarm
“Alarm should open an operational work item”
Alarm action to Systems Manager OpsCenter
Common traps
Lambda functions copying logs between accounts on a schedule.
Keeping years of logs in CloudWatch Logs instead of archiving to S3.
Forgetting new log groups: per-group subscription filters miss them; account-level policies don’t.
One alarm per error message, which floods on-call staff.
Logs editable by workload accounts; the archive belongs in a separate log archive account.
A retailer runs about 40 AWS accounts, each with its own application log groups in CloudWatch Logs. The central operations team wants the logs of all accounts searchable in one account in near real time, so that an incident can be investigated without switching accounts.
The log groups must stay in their source accounts for their own retention, and the central team does not want to copy the logs by hand or on a nightly schedule.
Which solution meets these requirements?
Choose one answer.
AA. Export each account's log groups to an Amazon S3 bucket in the central account every night with a scheduled export task, and have the central team search the exported files with Amazon Athena when needed.
BB. Set up CloudWatch cross-account observability with the central account as the monitoring account and the 40 accounts as source accounts sharing their log groups, and query with Logs Insights.
CC. Set up a CloudWatch dashboard in each account, and ask the central team to log in to each account to view its dashboards during an incident.
DD. Write a cron job on a server in each account that copies the new log lines to a central log group every 15 minutes.
Show the answer and explanation
Answer: B
A. Wrong: Nightly exports are not near real time, and the logs would be a day old during an incident. The option also adds a copy process the central team wants to avoid.
B. Right: Correct. Cross-account observability lets the monitoring account search and analyze the source accounts' log groups without copying them, so each log group keeps its own retention. New log events are available to the central team as they arrive.
C. Wrong: The central team would still switch accounts, which the team wants to avoid. Dashboards also show only the metrics they are built with, not the logs themselves.
D. Wrong: The cron jobs are custom copy processes that the central team wants to avoid, and each one must be maintained across 40 accounts. A 15-minute delay is also slower than the subscription approach.
Explanation
CloudWatch cross-account observability lets one monitoring account search the log groups of all linked accounts in near real time, while each log group stays in its source account with its own retention. Nightly exports, per-account dashboards and copy scripts each add delay or manual work the requirements rule out.
Want more on Multi-account log aggregation and alerting? The 5 full-length practice sets have 7 more Multi-account log aggregation and alerting questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →