Cloudwatch insights

Question

Is it possible to setup cloudwatch Insight JSON rules on log groups that are in other AWS accounts? We have our monitoring stack setup in another account, we'd like for our service accounts to talk to monitoring accounts to pull out cloudwatch insight graphs on a dashboard in service accounts. Any help will be appreciated. I've tried following instructions in this article with no luck getting insight rules to display data - https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Cross-Account-Cross-Region.html

But since cloudwatch insight rules work with log group names and not ARNs, wondering if its even possible?

Answer

Since it sounds like you're centralizing your monitoring, I would recommend centralizing your logging as well. That's the way I see most customers with your goal go. [This solution](https://aws.amazon.com/solutions/implementations/centralized-logging/) can help you do that.

As far as "can you have CloudWatch Insight query logs in other accounts?", I don't believe that's possible, because I haven't seen anyone do that and because [the docs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html) don't mention anything about cross-account for CloudWatch Logs Insights queries. I'll try to update those docs to make that limitation clearer.

Cloudwatch insights

Relevant content