Centralizing Logs from Multiple AWS Accounts with CloudWatch Logs
A company wants to centrally collect and analyze logs from multiple AWS accounts. Which AWS service should be used to aggregate logs from various sources for monitoring and alerting?
Quick Answer
The answer is Amazon CloudWatch Logs, as it is the native AWS service designed to centralize logs from multiple accounts for monitoring and alerting. CloudWatch Logs achieves this through cross-account log group subscriptions, where logs from member accounts can be streamed into a central monitoring account, or by using Amazon Kinesis Data Streams as an intermediary to aggregate log data from various sources before ingestion. On the AWS Certified Security Specialty SCS-C02 exam, this question tests your understanding of log aggregation architecture versus other services’ specific roles—a common trap is confusing CloudTrail (which only records API activity) or S3 (a storage layer, not a monitoring service) with CloudWatch Logs’ broader log collection capability. Remember the memory tip: “CloudWatch watches all logs; CloudTrail trails only API calls.”
⚠ Common exam trap
Candidates often confuse AWS CloudTrail (which records API calls) with a log aggregation service, but CloudTrail is a log source, not a centralized aggregation and analysis platform like CloudWatch Logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon CloudWatch Logs
Amazon CloudWatch Logs is the correct service because it provides a centralized platform for collecting, monitoring, and analyzing log data from multiple AWS accounts and on-premises sources. It supports cross-account log aggregation via subscription filters and cross-account destinations, enabling real-time monitoring and alerting through CloudWatch Logs Insights and metric filters. This makes it the appropriate choice for the stated requirement of central log aggregation for monitoring and alerting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon S3
Why it's wrong here
Amazon S3 stores objects but performs no log ingestion, correlation, or alerting; aggregating multi-account logs there leaves analysis to another service. S3 is the right destination when the requirement is durable, cost-effective archival or a data lake feeding separate query tooling, not native monitoring and alerting.
- ✗
AWS Config
Why it's wrong here
AWS Config records resource configuration changes and evaluates compliance rules; it does not ingest application, VPC flow, or CloudTrail log streams for centralised analysis. Config is correct when the goal is tracking configuration drift and resource compliance state across accounts, not aggregating heterogeneous log sources.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail records API activity within accounts but does not aggregate arbitrary log sources such as application or VPC flow logs, nor provide the querying and alerting layer described. CloudTrail is the right choice when the requirement is auditing AWS API calls and delivering those events to a central store.
- ✓
Amazon CloudWatch Logs
Why this is correct
CloudWatch Logs accepts log streams from many sources, including CloudTrail, VPC Flow Logs and application agents, and supports metric filters, alarms and cross-account subscriptions. That aggregation plus alerting capability satisfies the centralised collection requirement across accounts.
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Select TWO.)
easy- A.AWS Config
- ✓ B.Amazon Athena (to query logs in S3)
- ✓ C.Amazon S3 (as a central log repository)
- D.Amazon Inspector
- E.AWS Shield
Why B: Amazon S3 can serve as a centralized log repository by aggregating logs from multiple AWS accounts using cross-account S3 bucket policies. Amazon Athena can then query those logs directly in S3 using standard SQL, enabling centralized analysis without moving data. Together, they provide a scalable, serverless solution for multi-account log collection and analysis.
Variation 2. Which TWO AWS services can be used to centrally collect and analyze logs from multiple AWS accounts? (Choose two.)
medium- ✓ A.Amazon CloudWatch Logs
- B.AWS CloudTrail
- C.Amazon Kinesis Data Firehose
- D.Amazon Athena
- ✓ E.Amazon S3
Why A: Amazon CloudWatch Logs can centrally collect logs from multiple AWS accounts by using cross-account subscription filters or by aggregating logs into a central account via CloudWatch Logs destination. This enables centralized monitoring and analysis of log data from various sources, meeting the requirement for a multi-account log collection and analysis solution.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.