Is it good practice to use the Log Archive account as the Monitoring Account for a Cloudwatch cross-account monitoring setup

Question

I am using AWS Control Tower, and I was wondering if it was good practice to use the organization shared Log Archive account as the monitoring account for Cloudwatch cross-account monitoring.

Are there any risks involved with a setup like this? Ideally I would be creating a role in this Log Archive account that would be assumable by users who need to browse said cloudwatch data.

Riku_Kobayashi · Accepted Answer

Hello.

I guess it depends on the use case, but in my case I manage metrics separately from the log archive account.  
Log archive accounts contain logs that are important from a security and governance perspective, such as "AWS CloudTrail," which retrieves AWS operation history, and "AWS Config," which retrieves change history of AWS resources.  
In order to prevent such logs from being viewed by general users, I manage metrics using a different account.  
To prevent issues such as logs being deleted when incorrect permissions are granted to a user, we limit the number of users who can access the log archive account as much as possible.  
https://docs.aws.amazon.com/controltower/latest/userguide/logging-and-monitoring.html

AWS rePost Live · Answer

Thank you for submitting your question, George! We answered this on an episode of AWS re:Post Live. You can click this link and jump to 54:18 in the time code to listen to us discuss - https://www.twitch.tv/videos/2204463289

Ashishkumar Patel · Answer

Does it mean 'Security Tooling (Audit) account' is the right AWS account for monitoring?
If not, then having a separate account for monitoring is recommended, then what goes to the Security Tooling (Audit) account and the Monitoring account (per security and monitoring services)?

Is it good practice to use the Log Archive account as the Monitoring Account for a Cloudwatch cross-account monitoring setup

Add your answer

Relevant content