Is it good practice to use the Log Archive account as the Monitoring Account for a Cloudwatch cross-account monitoring setup

0

I am using AWS Control Tower, and I was wondering if it was good practice to use the organization shared Log Archive account as the monitoring account for Cloudwatch cross-account monitoring.

Are there any risks involved with a setup like this? Ideally I would be creating a role in this Log Archive account that would be assumable by users who need to browse said cloudwatch data.

1 Answer
0
Accepted Answer

Hello.

I guess it depends on the use case, but in my case I manage metrics separately from the log archive account.
Log archive accounts contain logs that are important from a security and governance perspective, such as "AWS CloudTrail," which retrieves AWS operation history, and "AWS Config," which retrieves change history of AWS resources.
In order to prevent such logs from being viewed by general users, I manage metrics using a different account.
To prevent issues such as logs being deleted when incorrect permissions are granted to a user, we limit the number of users who can access the log archive account as much as possible.
https://docs.aws.amazon.com/controltower/latest/userguide/logging-and-monitoring.html

profile picture
EXPERT
answered 25 days ago
profile picture
EXPERT
reviewed 25 days ago