- [Instructor] In this video,
you'll see how to enable cross-account observability
in Amazon CloudWatch.
With this capability,
you can set up a centralized monitoring account
in CloudWatch,
link multiple source accounts to it,
and then browse cross-account data
with the monitoring account.
This is the CloudWatch account we're going to use
as our centralized monitoring account.
To get started, let's configure its settings.
This configuration will be available for source accounts
in the specified AWS region,
which is US East, North Virginia.
Let's retain the default settings
for the types of telemetry data
we want this account to monitor.
Next, we'll list the specific source accounts
we want to monitor.
Let's paste in an organization path and an account ID.
Here, we can define a label to identify our source account
within the monitoring account.
We'll retain the default label and use the account name.
Next, we need to link source accounts
to this monitoring account.
Let's find out how.
We have two options for linking source accounts.
AWS Organization, the recommended option,
automatically onboards new accounts
as they're added to the organization.
The Any Account option
lets us link individual source accounts.
We can also combine the two approaches,
which we'll demonstrate in a moment.
First, let's link using AWS Organization.
Let's download the CloudFormation template.
Next, we'll log in
with the CloudFormation-delegated admin account
and navigate to AWS CloudFormation,
where we'll create a StackSet with this template.
We'll give the StackSet a name and proceed to the next step.
We'll retain the default StackSet options.
For our purposes, we'll deploy this StackSet to the US East,
North Virginia region.
Let's review our settings and create the StackSet.
Once the StackSet finishes launching,
we'll be able to sign into CloudWatch
with our monitoring account
to browse through our cross-account telemetry data.
Let's see what that looks like.
Here, we signed into CloudWatch with our monitoring account.
Let's navigate to settings
and go through the process of linking individual accounts
outside our AWS Organization.
We can download a template as before
or copy a link and share it to our accounts manually.
In this case, we'll use the link.
Let's copy the URL and navigate to it
from within the source account
whose ID we entered during the configuration process.
Now that we are logged in with our source account,
let's review and confirm the settings.
We'll confirm the linking of the accounts.
Now that we've seen how to link source accounts
to a monitoring account,
let's see how to disconnect a source account.
Because we added this source account manually,
we can stop sharing data with this monitoring account
in a few clicks.
In this case, let's not stop sharing data.
To disconnect source accounts
that were linked using CloudFormation stacks or StackSets,
we need to update the respective template
or delete the stack.
Let's return to the monitoring account settings.
Now we'll see how to connect a new source account manually
after we've already set up cross-account monitoring.
Let's take a look at our configuration policy.
Here, we can add principal accounts directly.
We can also remove permissions from accounts
to begin sharing with us.
We can also add or delete accounts programmatically
through CloudFormation, AWS SDKs, or the AWS CLI.
For further information, please refer to our documentation.
Let's go back to the CloudWatch homepage.
Let's take a look at the Service Map.
ServiceLens integrates traces, metrics, logs, alarms,
and other resource health information into one place
to offer a 360-degree view
of your cross-account applications, health, and performance.
We can filter the view to see one or more
of our linked accounts.
Let's drill down into this Lambda function,
which is associated
with the source account we linked earlier.
This gives us a quick overview of the function's metrics,
as well as any alerts.
We can select an alarm to see further details.
Here's a graph of the alarm details.
We can jump from here to our CloudWatch metrics.
Below the graph metrics, we have the applicable metadata,
including the account label and ID.
We can create a cross-account dashboard
or cross-account alarms from these cross-account metrics.
We can also browse the metrics.
We can view and operate on these cross-account metrics
as if we were viewing metrics from a single account.
As with the service map,
we can filter the metrics by a specific account.
We can also view our CloudWatch logs.
Let's run this query
and get insights on the various microservices
in our cross-account applications.
We can additionally filter
which log groups we would like to see the data for.
For example, we can filter by account label
and log group name.
We can also review and create cross-account alarms
in the monitoring account.
Here are the details of this specific alarm.
Additionally, we can use cross-account monitoring
to generate insights for multiple accounts.
Let's navigate to Contributor Insights
to create a rule allowing us to do so.
Once we select the log groups we want the rule to evaluate,
we can use Contributor Insights
as we would for an individual account.
For demonstration purposes, let's move on.
Here are some rules that are already set up.
We can view the cross-account log groups for each rule.
Next, let's navigate to Traces
to view the trace details that span across our accounts.
We'll refine our query by account.
Let's add the source account to the query and then run it.
Here's the trace data for that specific account.
You've just seen how to enable cross-account observability
in Amazon CloudWatch.
You can learn more about this topic
in the description and links for this video.
Thanks for watching, now it's your turn to try.