AWS AmazonCloudWatch documentation change
Summary
Expanded cross-account centralization documentation to include metrics alongside logs, updated feature descriptions, added metrics support details, and clarified pricing for centralized telemetry
Security assessment
Changes focus on feature enhancements (adding metrics centralization) and documentation improvements. No security vulnerabilities are mentioned or addressed. Updates describe functionality improvements without security implications or new security features.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/CloudWatch-Cross-Account-Methods.md b/AmazonCloudWatch/latest/monitoring/CloudWatch-Cross-Account-Methods.md index 6676d545c..50bbabd80 100644 --- a//AmazonCloudWatch/latest/monitoring/CloudWatch-Cross-Account-Methods.md +++ b//AmazonCloudWatch/latest/monitoring/CloudWatch-Cross-Account-Methods.md @@ -15 +15 @@ To enable unified monitoring across accounts, CloudWatch offers the following fe - * **[Cross-account cross-Region log centralization](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs_Centralization.html)** – collects copies of log data from multiple member accounts into one data repository using cross-account and cross-region centralization rules. You define the rules that automatically replicate log data from multiple accounts and AWS Regions into a centralized account within your organization. This capability streamlines log consolidation for improved centralized monitoring, analysis, and compliance across your entire AWSinfrastructure. + * **Cross-account cross-Region centralization** – Amazon CloudWatch centralization capability streamlines log and metrics consolidation for improved centralized monitoring, analysis, and compliance across your entire AWS infrastructure. You define centralization rules that control what gets centralized, enabling unified monitoring, alarming, and analysis from a single destination. For more information, see [Cross-account cross-Region log centralization](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs_Centralization.html) and [Cross-account cross-Region metrics centralization](./CloudWatchMetrics_Centralization.html). @@ -20 +20 @@ To enable unified monitoring across accounts, CloudWatch offers the following fe -These three features are complementary to each other and can be used independently or together. See the following table for a comparison of the features. We recommend that you use CloudWatch cross-account observability for the richest cross-account observability and discovery experience within a Region for your metrics, logs, and traces. +These features are complementary to each other and can be used independently or together. See the following table for a comparison of the features. We recommend that you use CloudWatch cross-account observability for the richest cross-account observability and discovery experience within a Region for your metrics, logs, and traces. @@ -22 +22 @@ These three features are complementary to each other and can be used independent -| **[CloudWatch cross-account observability](./CloudWatch-Unified-Cross-Account.html)** | **[Cross-account cross-Region CloudWatch console](./Cross-Account-Cross-Region.html)** | **[Cross-account cross-Region log centralization](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs_Centralization.html)** +| **[CloudWatch cross-account observability](./CloudWatch-Unified-Cross-Account.html)** | **[Cross-account cross-Region CloudWatch console](./Cross-Account-Cross-Region.html)** | **Cross-account cross-Region centralization** @@ -24,2 +24,2 @@ These three features are complementary to each other and can be used independent -**What is it?** | Unified access to underlying telemetry and other observability resources across multiple accounts. After this is configured, observability resources are seamlessly viewable between accounts, eliminating the need for role assumptions. The central monitoring account gains direct access to the telemetry data and resources from source accounts, streamlining the monitoring and observability process. | A designated monitoring account assume a **CrossAccountSharingRole** defined in source accounts from the CloudWatch console. By assuming this role, the monitoring account can invoke operations such as dashboard viewing on behalf of source accounts, directly from its console. | Amazon CloudWatch Logs data centralization capability streamlines log consolidation for improved centralized monitoring, analysis, and compliance across your entire AWS infrastructure. -**How does it work?** | A monitoring account, using the Observability Access Monitoring service, creates a _sink_ and attaches a sink policy to it. The sink policy defines which resources they would like to view and which source accounts should share them. Then source accounts can create a link to the monitoring account sink, establishing what they actually want to share. After the link is created, the specified resources are visible in the monitoring account. | A source account initiates the configuration by setting up a **CrossAccountSharingRole** , allowing a monitoring account to run operations in the source account. Then, a monitoring account enables the cross-account cross-Region selector in the console by specifying the source account ID. This enables the monitoring account to be able to switch into the source account. When switching, the CloudWatch console checks for the existence of a service-linked role that allows CloudWatch to assume the **CrossAccountSharingRole** that was created in the source account. | Amazon CloudWatch Logs data centralization works with AWS Organizations to copy log data from multiple member accounts into one data repository using cross-account and cross-region centralization rules. You define the rules that automatically replicate log data from multiple accounts and AWS Regions into a centralized account within your organization. +**What is it?** | Unified access to underlying telemetry and other observability resources across multiple accounts. After this is configured, observability resources are seamlessly viewable between accounts, eliminating the need for role assumptions. The central monitoring account gains direct access to the telemetry data and resources from source accounts, streamlining the monitoring and observability process. | A designated monitoring account assume a **CrossAccountSharingRole** defined in source accounts from the CloudWatch console. By assuming this role, the monitoring account can invoke operations such as dashboard viewing on behalf of source accounts, directly from its console. | Amazon CloudWatch centralization capability streamlines log and metrics consolidation for improved centralized monitoring, analysis, and compliance across your entire AWS infrastructure. +**How does it work?** | A monitoring account, using the Observability Access Monitoring service, creates a _sink_ and attaches a sink policy to it. The sink policy defines which resources they would like to view and which source accounts should share them. Then source accounts can create a link to the monitoring account sink, establishing what they actually want to share. After the link is created, the specified resources are visible in the monitoring account. | A source account initiates the configuration by setting up a **CrossAccountSharingRole** , allowing a monitoring account to run operations in the source account. Then, a monitoring account enables the cross-account cross-Region selector in the console by specifying the source account ID. This enables the monitoring account to be able to switch into the source account. When switching, the CloudWatch console checks for the existence of a service-linked role that allows CloudWatch to assume the **CrossAccountSharingRole** that was created in the source account. | Uses AWS Organizations trusted access. An administrator creates a centralization rule in the management or delegated administrator account that defines source accounts/OUs/Regions and a destination account/Region. Logs and metrics arriving in source accounts are automatically copied to the destination with source metadata (account ID and Region) added. @@ -39,0 +40 @@ These three features are complementary to each other and can be used independent + * Metrics @@ -57 +58 @@ These three features are complementary to each other and can be used independent -For more details, see [Cross-account cross-Region CloudWatch console](./Cross-Account-Cross-Region.html). | CloudWatch Logs InsightsSubscription filtersMetric filters +For more details, see [Cross-account cross-Region CloudWatch console](./Cross-Account-Cross-Region.html). | Logs: CloudWatch Logs Insights, Subscription filters, Metric filtersMetrics: Custom via PutMetricData, Embedded Metric Format (EMF), OpenTelemetry (OTLP) @@ -60 +61 @@ For more details, see [Cross-account cross-Region CloudWatch console](./Cross-Ac -**How much does it cost?** | No extra charges for shared logs and metrics, and the first trace copy is free. For more information about pricing, see [Amazon CloudWatch pricing](http://aws.amazon.com/cloudwatch/pricing). | No additional charges for cross-account or cross-Region actions. | You can centralize one copy of logs for free. Additional copies are charged at $0.05/GB of logs centralized (the backup region feature is considered an additional copy). For information about storage cost pricing in the destination account and other value-added experiences see [Amazon CloudWatch Pricing](https://aws.amazon.com/cloudwatch/pricing/). +**How much does it cost?** | No extra charges for shared logs and metrics, and the first trace copy is free. For more information about pricing, see [Amazon CloudWatch pricing](http://aws.amazon.com/cloudwatch/pricing). | No additional charges for cross-account or cross-Region actions. | The first copy of centralized telemetry is free. An optional backup region (second copy) is a paid feature. For more information, see [Amazon CloudWatch Pricing](https://aws.amazon.com/cloudwatch/pricing/). @@ -71,0 +73,2 @@ For more details, see [Cross-account cross-Region CloudWatch console](./Cross-Ac + * [Cross-account cross-Region metrics centralization](./CloudWatchMetrics_Centralization.html) +