Cross-Account CloudWatch Observability with AWS Organizations

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

A Enable CloudWatch cross-account observability and deploy the provided CloudFormation template in each member account.

Question

A company uses an organization in AWS Organizations to manage AWS accounts that contain applications. The company sets up a dedicated monitoring member account in the organization. The company wants to query and visualize observability data across the accounts by using Amazon CloudWatch. Which solution will meet these requirements?
  1. Enable CloudWatch cross-account observability for the monitoring account. Deploy an AWS CloudFormation template provided by the monitoring account in each AWS account to share the data with the monitoring account. Correct Answer
  2. Set up service control policies (SCPs) to provide access to CloudWatch in the monitoring account under the Organizations root organizational unit (OU).
  3. Configure a new IAM user in the monitoring account. In each AWS account, configure an IAM policy to have access to query and visualize the CloudWatch data in the account. Attach the new IAM policy to the new IAM user.
  4. Create a new IAM user in the monitoring account. Create cross-account IAM policies in each AWS account. Attach the IAM policies to the new IAM user.

Key Takeaways

The exam tests knowledge of modern, automated cross-account monitoring features in CloudWatch rather than manual IAM role switching or SCPs.

This question tests the correct method for querying and visualizing observability data across multiple AWS accounts using Amazon CloudWatch. The solution involves enabling cross-account observability and deploying a shared CloudFormation template.

Common mistake: Learners often select option C or D, assuming that configuring IAM users and policies is the standard way to handle cross-account access, missing the specific CloudWatch feature designed for this scenario.

Expert Analysis

Why the Answer Is Correct

Option A is the correct answer because it leverages the native Cross-Account Observability feature introduced by AWS. This feature allows a designated monitoring account to query and visualize metrics from member accounts without requiring complex manual configurations in each account. The process involves enabling the feature at the organization level and deploying a centralized CloudFormation template (provided by AWS) to each member account to grant the necessary permissions automatically.

Why the Other Options Are Wrong

Options C and D suggest using IAM users and policies. While technically possible to assume roles across accounts, creating individual IAM users and manually attaching policies in every single account is not scalable, violates the principle of least privilege when done broadly, and is not the recommended 'solution' for observability aggregation. Option B suggests using Service Control Policies (SCPs). SCPs only restrict maximum permissions; they do not grant permissions or facilitate data sharing/visualization between accounts. They cannot enable CloudWatch dashboards to pull data from other accounts on their own.

Community Comment Notes

The community heavily favored Option A (91% votes), reflecting consensus on the modern best practice. Commenters provided links to official AWS documentation confirming the use of the CloudFormation template for setup. One dissenting vote for C was likely based on older methods of cross-account access before unified cross-account dashboards were available.

Official Reference

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When you see 'query and visualize... across accounts' with CloudWatch, look for solutions involving 'cross-account observability' or 'unified dashboards'. Avoid manual IAM policy configuration in every account as it is rarely the 'best' scalable answer in modern AWS exams.

Frequently Asked Questions

Why can't I just use IAM Roles instead of the CloudFormation template?

While IAM Roles are used under the hood, the CloudFormation template automates the creation and trust relationship configuration across all accounts, ensuring consistency and reducing manual errors.

Does Option B work if I attach an SCP allowing CloudWatch actions?

No. SCPs only define permission boundaries (deny lists). They do not grant permissions or enable the actual data flow and visualization capabilities required for cross-account dashboards.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. jaswantn 👍 7
    option A below are the links to check both parts of option A. https://docs.amazonaws.cn/en_us/AmazonCloudWatch/latest/monitoring/cloudwatch_crossaccount_dashboard.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account-Setup.html#Unified-Cross-Account-SetupSource-SingleTemplate
  2. Sivaeas 👍 6 Answered A
    https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account.html
  3. osmk 👍 4 Answered A
    https://docs.amazonaws.cn/en_us/AmazonCloudWatch/latest/monitoring/cloudwatch_crossaccount_dashboard.html
  4. Andy_09 👍 3
    Option A
  5. ninasgx 👍 1 Answered C
    It's C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide