Examkin

Question

Difficulty: MediumImproving Operational Excellence via Monitoring and Logging

A financial services company operates a microservices-based application running on Amazon ECS with AWS Fargate across ten member accounts within an AWS Organization. The operations team needs to build a centralized dashboard in a designated monitoring account to analyze application performance, query log groups, and view distributed service traces across all member accounts. The solution must minimize operational overhead and avoid manual infrastructure provisioning or custom log-routing agents. Which strategy should a Solutions Architect implement to meet these requirements?

  1. A
    Modify the ECS task definitions in each member account to include a sidecar container running the CloudWatch Agent. Configure the agent using a static JSON configuration file to stream local container logs and custom metrics directly to log groups in the central monitoring account using cross-account IAM roles assumed by the task execution role.
  2. Configure CloudWatch cross-account observability by creating a sink in the central monitoring account and defining links in the member accounts using AWS CloudWatch Observability Access Manager (OAM). Enable sharing for logs, metrics, and traces, and access the consolidated data from the monitoring account's CloudWatch console.Answer
  3. C
    Deploy an Amazon Kinesis Data Firehose delivery stream in each member account to collect container logs and send them to a centralized Amazon S3 bucket in the monitoring account. Use Amazon Athena to query the logs and Amazon QuickSight to visualize metrics, ensuring the S3 bucket policy is configured to allow cross-account writes from the member accounts' Firehose IAM roles.
  4. D
    Attach a Service Control Policy (SCP) at the root level of the AWS Organization that grants permission for ECS tasks to write CloudWatch logs and X-Ray traces directly to the monitoring account. Configure the ECS tasks to write to the central monitoring account's regional CloudWatch and X-Ray endpoints.

Answer

Configure CloudWatch cross-account observability by creating a sink in the central monitoring account and defining links in the member accounts using AWS CloudWatch Observability Access Manager (OAM). Enable sharing for logs, metrics, and traces, and access the consolidated data from the monitoring account's CloudWatch console.
The correct solution leverages Amazon CloudWatch cross-account observability using AWS CloudWatch Observability Access Manager (OAM). By creating a central sink in the monitoring account and linking the member accounts to it, the operations team can search logs, view consolidated metrics, and inspect traces across all accounts from the central console. This approach requires no agent maintenance or sidecar management, minimizing operational overhead.

Step-by-Step Solution

1
Create a centralized sink in the monitoring account using AWS CloudWatch Observability Access Manager (OAM).
A sink is provisioned with a resource policy allowing access from the Organization or member accounts.
This establishes a central endpoint to receive observability data.
2
Create links in each source member account pointing to the central sink's ARN, choosing to share metrics, logs, and traces.
The member accounts are securely connected to the central monitoring account.
This enables native AWS sharing of CloudWatch and X-Ray data without custom pipelines.
3
Open the CloudWatch console in the monitoring account to view consolidated metrics, run cross-account log searches, and inspect service traces.
Operational visibility is unified across all ten member accounts with minimal administrative overhead.
This provides a single pane of glass for monitoring and troubleshooting without custom scripts or agents.

Key Concept

CloudWatch Cross-Account Observability using AWS OAM
Rate this question

Topics

Improving Operational Excellence via Monitoring and Logging