AWS AmazonCloudWatch documentation change
Summary
Added documentation for Cross-account cross-Region log centralization feature, expanded comparison table to include this new capability, and updated feature details including pricing and AWS Organizations integration
Security assessment
The changes document a new log centralization feature that improves centralized monitoring and compliance, but there is no evidence of addressing a specific security vulnerability. The documentation emphasizes compliance and access control through AWS Organizations, which are security-adjacent features, but does not indicate remediation of an existing security flaw.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-Cross-Account-Methods.md b/AmazonCloudWatch/latest/monitoring/CloudWatch-Cross-Account-Methods.md index b76d5a596..453b6ed7a 100644 --- a//AmazonCloudWatch/latest/monitoring/CloudWatch-Cross-Account-Methods.md +++ b//AmazonCloudWatch/latest/monitoring/CloudWatch-Cross-Account-Methods.md @@ -12,0 +13 @@ To enable unified monitoring across accounts, CloudWatch offers the following fe + * **[Cross-account cross-Region log centralization](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs_Centralization.html)** – collects copies of log data from multiple member accounts into one data repository using cross-account and cross-region centralization rules. You define the rules that automatically replicate log data from multiple accounts and AWS Regions into a centralized account within your organization. This capability streamlines log consolidation for improved centralized monitoring, analysis, and compliance across your entire AWSinfrastructure. @@ -16 +16,0 @@ To enable unified monitoring across accounts, CloudWatch offers the following fe -These two features are complementary to each other and can be used independently or together. See the following table for a comparison of the two features. We recommend that you use CloudWatch cross-account observability for the richest cross-account observability and discovery experience within a Region for your metrics, logs, and traces. @@ -18,4 +18,6 @@ These two features are complementary to each other and can be used independently -| **[CloudWatch cross-account observability](./CloudWatch-Unified-Cross-Account.html)** | **[Cross-account cross-Region CloudWatch console](./Cross-Account-Cross-Region.html)** ----|---|--- -**What is it?** | Unified access to underlying telemetry and other observability resources across multiple accounts. After this is configured, observability resources are seamlessly viewable between accounts, eliminating the need for role assumptions. The central monitoring account gains direct access to the telemetry data and resources from source accounts, streamlining the monitoring and observability process. | A designated monitoring account assume a **CrossAccountSharingRole** defined in source accounts from the CloudWatch console. By assuming this role, the monitoring account can invoke operations such as dashboard viewing on behalf of source accounts, directly from its console. -**How does it work?** | A monitoring account, using the Observability Access Monitoring service, creates a _sink_ and attaches a sink policy to it. The sink policy defines which resources they would like to view and which source accounts should share them. Then source accounts can create a link to the monitoring account sink, establishing what they actually want to share. After the link is created, the specified resources are visible in the monitoring account. | A source account initiates the configuration by setting up a **CrossAccountSharingRole** , allowing a monitoring account to run operations in the source account. Then, a monitoring account enables the cross-account cross-Region selector in the console by specifying the source account ID. This enables the monitoring account to be able to switch into the source account. When switching, the CloudWatch console checks for the existence of a service-linked role that allows CloudWatch to assume the **CrossAccountSharingRole** that was created in the source account. +These three features are complementary to each other and can be used independently or together. See the following table for a comparison of the features. We recommend that you use CloudWatch cross-account observability for the richest cross-account observability and discovery experience within a Region for your metrics, logs, and traces. + +| **[CloudWatch cross-account observability](./CloudWatch-Unified-Cross-Account.html)** | **[Cross-account cross-Region CloudWatch console](./Cross-Account-Cross-Region.html)** | **[Cross-account cross-Region log centralization](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs_Centralization.html)** +---|---|---|--- +**What is it?** | Unified access to underlying telemetry and other observability resources across multiple accounts. After this is configured, observability resources are seamlessly viewable between accounts, eliminating the need for role assumptions. The central monitoring account gains direct access to the telemetry data and resources from source accounts, streamlining the monitoring and observability process. | A designated monitoring account assume a **CrossAccountSharingRole** defined in source accounts from the CloudWatch console. By assuming this role, the monitoring account can invoke operations such as dashboard viewing on behalf of source accounts, directly from its console. | Amazon CloudWatch Logs data centralization capability streamlines log consolidation for improved centralized monitoring, analysis, and compliance across your entire AWS infrastructure. +**How does it work?** | A monitoring account, using the Observability Access Monitoring service, creates a _sink_ and attaches a sink policy to it. The sink policy defines which resources they would like to view and which source accounts should share them. Then source accounts can create a link to the monitoring account sink, establishing what they actually want to share. After the link is created, the specified resources are visible in the monitoring account. | A source account initiates the configuration by setting up a **CrossAccountSharingRole** , allowing a monitoring account to run operations in the source account. Then, a monitoring account enables the cross-account cross-Region selector in the console by specifying the source account ID. This enables the monitoring account to be able to switch into the source account. When switching, the CloudWatch console checks for the existence of a service-linked role that allows CloudWatch to assume the **CrossAccountSharingRole** that was created in the source account. | Amazon CloudWatch Logs data centralization works with AWS Organizations to copy log data from multiple member accounts into one data repository using cross-account and cross-region centralization rules. You define the rules that automatically replicate log data from multiple accounts and AWS Regions into a centralized account within your organization. @@ -28 +30 @@ These two features are complementary to each other and can be used independently -. | +| @@ -32,0 +35,4 @@ These two features are complementary to each other and can be used independently +| + + * Logs + @@ -44 +50 @@ These two features are complementary to each other and can be used independently -. | +| @@ -49,8 +55,8 @@ These two features are complementary to each other and can be used independently -For more details, see [Cross-account cross-Region CloudWatch console](./Cross-Account-Cross-Region.html). -**How many accounts can I use it with?** | A monitoring account can see resources from as many as 100,000 source accounts at the same time. A source account can share their resources with as many as five different monitoring accounts. | By using the cross-account cross-Region selector in the console, a monitoring account can switch to one other account at a time but there is no limit on the number of accounts that can be linked. When defining cross-account dashboards and alarms, many source accounts can be referenced. -**Does it move telemetry data?** | No. Resources are shared between accounts with the exception of copied traces. | No. An IAM policy is configured to allow embedded account switching for cross-account cross-Region resource visibilty. -**How much does it cost?** | No extra charges for shared logs and metrics, and the first trace copy is free. For more information about pricing, see [Amazon CloudWatch pricing](http://aws.amazon.com/cloudwatch/pricing). | No additional charges for cross-account or cross-Region actions. -**Does it support observability across Regions?** | No | Yes -**Does it support programmatic access?** | Yes. the AWS CLI, AWS Cloud Development Kit (AWS CDK), and APIs are supported. | No. -**Does it support programmatic setup?** | Yes | Yes -**Does it support AWS Organizations?** | Yes | Yes +For more details, see [Cross-account cross-Region CloudWatch console](./Cross-Account-Cross-Region.html). | CloudWatch Logs InsightsSubscription filtersMetric filters +**How many accounts can I use it with?** | A monitoring account can see resources from as many as 100,000 source accounts at the same time. A source account can share their resources with as many as five different monitoring accounts. | By using the cross-account cross-Region selector in the console, a monitoring account can switch to one other account at a time but there is no limit on the number of accounts that can be linked. When defining cross-account dashboards and alarms, many source accounts can be referenced. | Works with AWS Organizations supported number of accounts +**Does it move telemetry data?** | No. Resources are shared between accounts with the exception of copied traces. | No. An IAM policy is configured to allow embedded account switching for cross-account cross-Region resource visibility. | Yes +**How much does it cost?** | No extra charges for shared logs and metrics, and the first trace copy is free. For more information about pricing, see [Amazon CloudWatch pricing](http://aws.amazon.com/cloudwatch/pricing). | No additional charges for cross-account or cross-Region actions. | You can centralize one copy of logs for free. Additional copies are charged at $0.05/GB of logs centralized (the backup region feature is considered an additional copy). For information about storage cost pricing in the destination account and other value-added experiences see [Amazon CloudWatch Pricing](https://aws.amazon.com/cloudwatch/pricing/). +**Does it support observability across Regions?** | No | Yes | Yes, you can centralize data across Regions. +**Does it support programmatic access?** | Yes. the AWS CLI, AWS Cloud Development Kit (AWS CDK), and APIs are supported. | No | Yes +**Does it support programmatic setup?** | Yes | Yes | Yes +**Does it support AWS Organizations?** | Yes | Yes | Yes. AWS Organizations is required to use this feature.