{"id":77855,"date":"2026-03-12T09:18:55","date_gmt":"2026-03-12T03:48:55","guid":{"rendered":"https:\/\/tothenewco.pro\/blog\/?p=77855"},"modified":"2026-03-16T15:41:52","modified_gmt":"2026-03-16T10:11:52","slug":"how-to-centralize-aws-monitoring-a-guide-to-cloudwatch-cross-account-metrics","status":"publish","type":"post","link":"https:\/\/tothenewco.pro\/blog\/how-to-centralize-aws-monitoring-a-guide-to-cloudwatch-cross-account-metrics\/","title":{"rendered":"How to Centralize AWS Monitoring: A Guide to CloudWatch Cross-Account Metrics"},"content":{"rendered":"
It is painfully inefficient to check metrics across a large collection of AWS accounts (development, staging, uat, production, etc.). This is a major time waster, not just a small irritation. In addition to wasting valuable engineering time, you run a much higher risk of missing an alert that could result in a full-blown outage every time you jump consoles or set up a redundant alarm.<\/p>\n
Use Case<\/h2>\n
This setup shines when you want one central monitoring account to see all CloudWatch metrics from your source accounts. From there you can:<\/p>\n
\n
Build unified dashboards<\/li>\n
Set up centralized alarms and notifications (e.g., via SNS)<\/li>\n
Investigate issues without logging into every account<\/li>\n
Scale alerting for production environments<\/li>\n<\/ul>\n
It’s especially useful for EC2, EKS, Lambda, or any service emitting CloudWatch metrics. Once linked, the monitoring account treats source metrics almost like native ones for graphing, alarming, and dashboards.<\/p>\n
The feature relies on Observability Access Manager (OAM) and is Region-specific<\/strong>.<\/p>\n
Prerequisites<\/h2>\n
\n
Admin-level access (or IAM policies for oam:*<\/code> actions for the POLP) in both accounts.<\/li>\n
Same AWS Region for sink and links (repeat setup per Region).<\/li>\n
Log in to the AWS Console with your central management account. Go to CloudWatch<\/strong> \u2192 Settings<\/strong><\/strong>\n
CloudWatch Settings<\/p><\/div><\/li>\n
Under Monitoring account configuration<\/strong>, click <\/span>Configure<\/strong>.<\/span><\/span>\n
CW Monitoring Account Setup<\/p><\/div><\/li>\n
Select Metrics<\/strong> as the data type to make visible from source accounts. Enter the source account ID. For Account label<\/strong>, choose Account Name<\/strong>. Click Confirm<\/strong>. This creates the OAM sink<\/strong>.\n
Configure OAM Sink<\/p><\/div><\/li>\n
The monitoring setup is done. Now copy the Sink ARN<\/strong>: Still in Settings \u2192 Monitoring account configuration \u2192 look under configuration details or Manage monitoring account<\/strong> section. Copy the full ARN.\n
Sink ARN<\/p><\/div><\/li>\n<\/ol>\n
Source Account<\/h3>\n\n
Log in to the source account. Go to CloudWatch<\/strong> \u2192 Settings<\/strong>.<\/li>\n
Click Configure source account<\/strong>.\n
CW Source Account Config<\/p><\/div><\/li>\n
Select Metrics<\/strong> as the data type. Paste the Monitoring account Sink ARN<\/strong> from step 4. Set Account label<\/strong> to Account Name<\/strong>. Click Link and Confirm. This creates the OAM link<\/strong> from source \u2192 monitoring.\n
Setup OAM Link<\/p><\/div><\/li>\n
That’s it for configuration. Metrics can be visible in 10 – 15 minutes<\/strong> in the monitoring account.<\/li>\n<\/ol>\n
Verification<\/h2>\n\n
In the source account<\/strong>: Go to CloudWatch<\/strong> \u2192 Metrics<\/strong> \u2192 All metrics<\/strong> \u2192 AWS\/EC2<\/strong> (or Per-Instance Metrics). Confirm your EC2 metrics (CPUUtilization, NetworkIn, etc.) are emitting normally.\n
EC2 metrics – Source Account<\/p><\/div><\/li>\n
In the monitoring account<\/strong>: Go to CloudWatch<\/strong> \u2192 Metrics<\/strong> \u2192 All metrics<\/strong>. Browse AWS\/EC2<\/strong> namespace. Metrics should appear with InstanceId dimensions. You can now create alarms, add to dashboards, or set up alerting – all centralized.\n
In each new source account: Repeat steps 5-7 (configure source, paste existing Sink ARN, set label).<\/li>\n<\/ol>\n
Key Considerations<\/h2>\n
\n
Historical Data<\/strong>: You don’t begin at zero. After linking, all historical metrics kept in the source account are instantly accessible to the monitoring account.<\/li>\n
Region Specificity<\/strong>: OAM Sinks are Region-specific. If you have resources in us-east-1 and eu-west-1, you must repeat this setup for both Regions.<\/li>\n
No Extra Cost<\/strong>: CloudWatch cross-account observability for metrics and logs comes at no additional cost. You only pay for the underlying metrics and logs ingestion.<\/li>\n<\/ul>\n
Conclusion<\/h2>\n
Once set up, this turns fragmented monitoring into a single pane of glass-perfect for faster troubleshooting and cleaner alerting. You no longer need to “context switch” between accounts to understand the health of your entire stack.<\/p>\n
Automate Cross-Account Observability with AWS Organizations<\/h2>\n
If you are managing a large number of accounts, manually linking each one is inefficient. (For a detailed, organization-level guide on this automation, see our companion blog: ‘From Zero to Hundreds: Onboarding Your Entire AWS Fleet to Centralized CloudWatch in Under an Hour<\/strong>‘.)<\/p>\n
\n
Automatic Onboarding<\/strong>: To have new accounts added automatically, designate your entire AWS Organization or certain Organisational Units (OUs) as the “Source.”<\/li>\n
CloudFormation StackSets:<\/strong> Deploy the OAM “Link” to all current and future accounts automatically using StackSets. New accounts gain instant visibility in your central monitoring hub without manual intervention.<\/li>\n
Centralized Governance:<\/strong> Manage permissions and ensure observability is never accidentally disabled by enforcing controls at scale using Service Control Policies (SCPs).<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
It is painfully inefficient to check metrics across a large collection of AWS accounts (development, staging, uat, production, etc.). This is a major time waster, not just a small irritation. In addition to wasting valuable engineering time, you run a much higher risk of missing an alert that could result in a full-blown outage every […]<\/p>\n","protected":false},"author":1811,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":62,"footnotes":""},"categories":[2348],"tags":[248,8377,8380,8379,5547,1266,7459,8378,1892,1499,8376,7501,7723],"class_list":["post-77855","post","type-post","status-publish","format-standard","hentry","category-devops-technology","tag-aws","tag-awscloudwatch","tag-awsmonitoring","tag-awsorganizations","tag-cloudarchitecture","tag-cloudwatch","tag-cloudwatchmetrics","tag-crossaccountobservability","tag-devops","tag-monitoring","tag-oam","tag-observability","tag-sre"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t
![\"CW](\"https:\/\/tothenewco.pro\/blog\/wp-ttn-blog\/uploads\/2026\/02\/1.-CloudWatch-_-us-east-1.png\")
![\"CW](\"https:\/\/tothenewco.pro\/blog\/wp-ttn-blog\/uploads\/2026\/02\/2.-Screenshot-2026-02-16-190558.png\")
![\"Configure](\"https:\/\/tothenewco.pro\/blog\/wp-ttn-blog\/uploads\/2026\/02\/3.-Monitoring-account-configuration-_-Settings-_-CloudWatch-_-us-east-1.png\")
![\"Sink](\"https:\/\/tothenewco.pro\/blog\/wp-ttn-blog\/uploads\/2026\/02\/5.-Manage-monitoring-account-_-Settings-_-CloudWatch-_-us-east-1.png\")
![\"CW](\"https:\/\/tothenewco.pro\/blog\/wp-ttn-blog\/uploads\/2026\/02\/6.-Settings-_-CloudWatch-_-us-east-1.png\")
![\"Setup](\"https:\/\/tothenewco.pro\/blog\/wp-ttn-blog\/uploads\/2026\/02\/7.-Source-account-configuration-_-Settings-_-CloudWatch-_-us-east-1.png\")
![\"EC2](\"https:\/\/tothenewco.pro\/blog\/wp-ttn-blog\/uploads\/2026\/02\/9.-Metrics-_-CloudWatch-_-us-east-1.png\")
![\"EC2](\"https:\/\/tothenewco.pro\/blog\/wp-ttn-blog\/uploads\/2026\/02\/10.-Metrics-_-CloudWatch-_-us-east-1.png\")