Q7 — AWS SAA-C03 Ch.12

Question 7 of 100 | ← Chapter 12

Q807. A company uses an organization in AWS Organizations to manage AWS accounts that contain applications. The company sets up a dedicated monitoring member account in the organization. The company wants to query and visualize observability data across the accounts by using Amazon CloudWatch.Which solution will meet these requirements?

• A. Enable CloudWatch cross-account observability for the monitoring account. Deploy an AWS CloudFormation template provided by the monitoring account in each AWS account to share the data with the monitoring account. ✓
• B. Set up service control policies (SCPs) to provide access to CloudWatch in the monitoring account under the Organizations root organizational unit (OU).
• C. Configure a new IAM user in the monitoring account. In each AWS account, configure an IAM policy to have access to query and visualize the CloudWatch data in the account. Attach the new IAM policy to the new IAM user.
• D. Create a new IAM user in the monitoring account. Create cross-account IAM policies in each AWS account. Attach the IAM policies to the new IAM user.

Correct Answer: A. Enable CloudWatch cross-account observability for the monitoring account. Deploy an AWS CloudFormation template provided by the monitoring account in each AWS account to share the data with the monitoring account.

Explanation

To query and visualize observability data from multiple AWS accounts using Amazon CloudWatch within an AWS Organizations setup, the recommended solution is:A. Enable CloudWatch cross-account observability for the monitoring account. Deploy an AWS CloudFormation template provided by the monitoring account in each AWS account to share the data with the monitoring account.Option A provides a scalable and centralized solution for querying and visualizing observability data across multiple AWS accounts:\1. Enabling CloudWatch cross-account observability allows the monitoring account to access and analyze CloudWatch metrics and logs from other member accounts within the organization.\2. Deploying an AWS CloudFormation template, provided by the monitoring account, in each AWS account ensures that the necessary resources and permissions are correctly set up to share the data with the monitoring account. This template typically includes IAM roles, policies, and necessary configurations.By following this approach, the company can effectively centralize and visualize observability data across multiple AWS accounts using the dedicated monitoring account.Here's why the other options are not the best fit for the given requirements:B. Setting up service control policies (SCPs) at the root organizational unit (OU) level: SCPs are used to set permissions and access controls at the organizational unit level and are not directly related to querying and visualizing CloudWatch data.C. Configuring a new IAM user in the monitoring account and attaching IAM policies to each AWS account: This option would require manual configuration and management of IAM policies in each AWS account, leading to increased administrative overhead and potential inconsistencies.D. Creating a new IAM user in the monitoring account and attaching cross-account IAM policies: This option is similar to option C and would require manual configuration and management of cross-account IAM policies in each AWS account.Therefore, the recommended solution for querying and visualizing observability data across AWS accounts using Amazon CloudWatch within an AWS Organizations setup is:A. Enable CloudWatch cross-account observability for the monitoring account. Deploy an AWS CloudFormation template provided by the monitoring account in each AWS account to share the data with the monitoring account.