CloudWatch OAM
CloudWatch Observability Access Manager (OAM) lets one AWS account, the monitoring account, read the logs, metrics and traces of other accounts as if they were its own. The platform uses it so that operators and the security team see core-root, core-audit, core-network and the four workload accounts from core-security without holding a role in each.
What it does
OAM has two parts. A sink is created in the monitoring account and carries a sink policy that says which accounts may connect and which telemetry types they may share. A link is created in each source account and points at the sink. Once linked, the monitoring account can query the source account's log groups, plot its metrics and view its traces in its own console, and can build alarms on the shared metrics. Sharing is read-only: the monitoring account cannot change or delete anything in a source account. OAM is regional, so links and sinks must be in the same region.
How BuiltForProd uses it
The observability-sink unit (module modules/observability, listed by the core/security/us-west-2 stack file) creates the sink in core-security. Its policy is scoped to the organization with aws:PrincipalOrgID, so any account in the organization may link and no outside account can. Three telemetry types are shared: AWS::CloudWatch::Metric, AWS::Logs::LogGroup and AWS::XRay::Trace.
The observability-link unit is listed by the stack files of core-root, core-audit, core-network and every plat-* account. Each link reads the sink ARN from the sink unit and connects the account. Each region's links point at that region's sink.
The CIS alarm flow depends on this. The seven metric filters must live in core-root, the account that owns the CloudTrail log group. The alarms live in core-security and reference the metrics with a metric query whose account_id is core-root; a plain metric reference would only look at the alarm's own account and stay in INSUFFICIENT_DATA. With source_account_id empty, modules/cloudwatch-alarms falls back to the same-account form.
For application teams, OAM means that the CloudWatch log groups written by Fluent Bit in plat-prod, the EKS control-plane logs and the X-Ray traces of the ETL trigger are all searchable from one Logs Insights console in core-security, while the source accounts keep ownership and retention of their data.
Terms you will see
| Term | Meaning |
|---|---|
| Monitoring account | The account that receives telemetry; core-security here. |
| Source account | An account that shares telemetry through a link. |
| Sink | The receiving endpoint in the monitoring account. |
| Sink policy | The resource policy that decides which accounts may link and what they share. |
| Link | The connection from a source account to a sink. |
aws:PrincipalOrgID | The condition key that restricts the sink to the organization. |
Metric query with account_id | The alarm form that evaluates a linked account's metric. |
Where to read more
- AWS Baseline overview for the security account's other duties.
- CloudWatch for the log groups and alarms that OAM makes visible.
- X-Ray for the traces shared through the same link.