Why Centralize CloudWatch Monitoring with AWS Organizations?<\/h2>\n\n- A single pane of glass:<\/b> EC2, Lambda, EKS, RDS – all your metrics in one place, searchable by account name or ID.<\/li>\n
- Unified dashboards and alarms:<\/b> Build cross-account dashboards and set up SNS notifications from one account, not twenty.<\/li>\n
- Faster troubleshooting:<\/b> Correlate issues across accounts without logging in and out repeatedly.<\/li>\n
- Zero-effort scaling:<\/b> New AWS accounts added to your organization automatically get linked – no manual setup required.<\/li>\n
- No extra cost:<\/b> You only pay for your normal CloudWatch usage. The cross-account observability layer itself doesn’t add to your bill.<\/li>\n
- Instant historical data:<\/b> Once a source account links, all its retained metric history becomes visible immediately in your monitoring account.<\/li>\n<\/ul>\n
Important note<\/b>: This is Region-specific (e.g., repeat for us-east-1, eu-west-1). OAM works best with AWS Organizations for automatic linking.<\/p>\nPrerequisites<\/h2>\n\n- AWS Organizations enabled with member accounts<\/li>\n
- Admin access in the management account (for StackSets)<\/li>\n
- Delegated admin permissions if needed (often the management account handles this)<\/li>\n
- Choose your central monitoring account<\/b> (can be the management account or a dedicated one)<\/li>\n
- Target Region ready (e.g., N. Virginia \/ us-east-1)<\/li>\n<\/ul>\n
Step-by-Step Setup: Configure Centralized Monitoring<\/h2>\nIn the Monitoring Account<\/h3>\n\n- Log in to the AWS Management Console and go to AWS Organizations <\/b>and confirm your org is set up correctly.\n
![\"AWS](\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/03\/image12.png\")
AWS Organizations<\/p><\/div><\/li>\n
- Navigate to CloudWatch<\/b> > Settings<\/b>.<\/li>\n
- Under Monitoring account configuration<\/b>, click Configure<\/b>.\n
![\"Cloudwatch](\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/03\/image10.png\")
Cloudwatch Settings<\/p><\/div><\/li>\n
- Select Metrics<\/b> (and Logs\/Traces if you need those too). Enter your Organization ID<\/b> or specific OU ID to scope the access. Set the Account label to “Account Name”<\/b> – this makes it much easier to identify accounts when you’re browsing metrics later. Hit Confirm<\/b>.<\/li>\n<\/ol>\n
This action creates the OAM sink<\/b> – the central collection point where metrics from all your source accounts will flow into.<\/p>\n![\"Monitoring](\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/03\/image8.png\")
Monitoring Account Configuration<\/p><\/div>\n
\n- Go to Resources to link accounts<\/b> (or similar section under configuration).\n
![\"Monitoring](\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/03\/image1.png\")
Monitoring Account Configuration<\/p><\/div><\/li>\n
- Download the CloudFormation template<\/b> provided by AWS. This template creates the necessary OAM links in source accounts.\n
![\"Source](\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/03\/image4.png\")
Source Account Cfn Template<\/p><\/div><\/li>\n<\/ol>\n
Deploy StackSets for Automatic Onboarding<\/h2>\n
This is where the magic happens. Instead of manually setting up links in every account, you let CloudFormation do the heavy lifting.<\/p>\n
\n- Still in the monitoring account (or management account with delegated CloudFormation access), go to CloudFormation<\/b> > StackSets<\/b> > Create StackSet<\/b>.\n
![\"Cfn](\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/03\/6.png\")
Cfn Stacksets<\/p><\/div><\/li>\n
- Upload or select the template you downloaded in step 6.\n
![\"Upload](\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/03\/image11.png\")
Upload Cfn Template<\/p><\/div><\/li>\n
- Give your StackSet a clear, descriptive name – something like cw-cross-account-monitoring<\/b> works well.<\/li>\n
- Add tags. This step is easy to skip, but don’t. Tags let you apply SCPs (Service Control Policies) to prevent accidental deletion of these monitoring stacks – something you’ll thank yourself for later.<\/li>\n
- Select only the region you’re configuring<\/b> (e.g., us-east-1). This is important: deploying to multiple regions in a single StackSet can cause failures. Do one region at a time.\n
![\"Set](\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/03\/image9.png\")
Set Cfn Deployment Options<\/p><\/div><\/li>\n
- Choose your deployment targets: your entire Organization, specific OUs, or individual accounts.<\/li>\n
- Configure permissions (service-managed permissions via AWS Organizations is the easiest option here).<\/li>\n
- Review and create the StackSet. CloudFormation rolls the stack out to all targeted accounts automatically.<\/li>\n<\/ol>\n
Once complete, you can check CloudFormation > Stack Instances<\/b> to see the deployment status in each account. Green across the board is what you’re looking for.<\/p>\n![\"Cfn](\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/03\/image3.png\")
Cfn Stack Instances<\/p><\/div>\n
Verification: Confirm It Works<\/h2>\nIn a Source Account (e.g., Account 1)<\/h3>\n\n- Go to CloudFormation<\/b> > Stacks<\/b>. You should see the OAM link stack deployed automatically (from the central StackSet).\n
![\"Cfn](\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/03\/image6.png\")
Cfn Stacks<\/p><\/div><\/li>\n
- Navigate to CloudWatch<\/b> > Metrics<\/b> > All metrics<\/b> > AWS\/EC2<\/b> > Per-Instance Metrics<\/b>. Confirm your EC2 metrics (CPUUtilization, NetworkIn, etc.) are emitting normally.\n
![\"Instance](\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/03\/image7.png\")
Instance Metrics in CW of Account1<\/p><\/div><\/li>\n<\/ul>\n
In the Monitoring Account (Central Hub)<\/h3>\n\n- Go to CloudWatch<\/b> > Metrics<\/b> > All metrics<\/b> > AWS\/EC2<\/b> > Per-Instance Metrics<\/b>.<\/li>\n
- Search by Account ID (e.g., ending in 1725) or Account Name label.<\/li>\n
- You’ll see the same EC2 metrics from the source account(s) appearing here – cross-account visibility is live!\n
![\"Instance](\"https:\/\/www.tothenew.com\/blog\/wp-ttn-blog\/uploads\/2026\/03\/image5.png\")
Instance Metrics in CW of Monitoring Account<\/p><\/div><\/li>\n<\/ul>\n
Now you’re set: Create dashboards, alarms, and notifications centrally. One place for your entire fleet.<\/p>\n
Key Benefits and Tips<\/h2>\n\n- Automatic scaling<\/b>: New accounts added to the Organization or OU get onboarded instantly via StackSets.<\/li>\n
- Governance<\/b>: Use tags + SCPs to protect monitoring resources (prevent accidental deletion).<\/li>\n
- No manual links<\/b>: Skip per-account setup for hundreds of accounts.<\/li>\n
- Historical metrics<\/b>: All retained data from source accounts becomes visible immediately.<\/li>\n
- Multi-Region<\/b>: Repeat the process per Region.<\/li>\n<\/ul>\n
For even tighter control, delegate CloudFormation StackSets admin to your monitoring account.<\/p>\n
Wrapping Up<\/h2>\n
Setting up centralized CloudWatch monitoring used to feel like a project that needed weeks of planning. With AWS Organizations, OAM, and CloudFormation StackSets, it’s genuinely achievable in under an hour – even for organizations running hundreds of accounts.<\/p>\n
The payoff is significant: fewer missed alerts, faster incident response, cleaner dashboards, and an architecture that scales on its own. Once you’ve gone through the setup once, you’ll wonder how you managed without it.<\/p>\n
Important note<\/b>: This is Region-specific (e.g., repeat for us-east-1, eu-west-1). OAM works best with AWS Organizations for automatic linking.<\/p>\n AWS Organizations<\/p><\/div><\/li>\n Cloudwatch Settings<\/p><\/div><\/li>\n This action creates the OAM sink<\/b> – the central collection point where metrics from all your source accounts will flow into.<\/p>\n Monitoring Account Configuration<\/p><\/div>\n Monitoring Account Configuration<\/p><\/div><\/li>\n Source Account Cfn Template<\/p><\/div><\/li>\n<\/ol>\n This is where the magic happens. Instead of manually setting up links in every account, you let CloudFormation do the heavy lifting.<\/p>\n Cfn Stacksets<\/p><\/div><\/li>\n Upload Cfn Template<\/p><\/div><\/li>\n Set Cfn Deployment Options<\/p><\/div><\/li>\n Once complete, you can check CloudFormation > Stack Instances<\/b> to see the deployment status in each account. Green across the board is what you’re looking for.<\/p>\n Cfn Stack Instances<\/p><\/div>\n Cfn Stacks<\/p><\/div><\/li>\n Instance Metrics in CW of Account1<\/p><\/div><\/li>\n<\/ul>\n Instance Metrics in CW of Monitoring Account<\/p><\/div><\/li>\n<\/ul>\n Now you’re set: Create dashboards, alarms, and notifications centrally. One place for your entire fleet.<\/p>\n For even tighter control, delegate CloudFormation StackSets admin to your monitoring account.<\/p>\n Setting up centralized CloudWatch monitoring used to feel like a project that needed weeks of planning. With AWS Organizations, OAM, and CloudFormation StackSets, it’s genuinely achievable in under an hour – even for organizations running hundreds of accounts.<\/p>\n The payoff is significant: fewer missed alerts, faster incident response, cleaner dashboards, and an architecture that scales on its own. Once you’ve gone through the setup once, you’ll wonder how you managed without it.<\/p>\nPrerequisites<\/h2>\n
\n
Step-by-Step Setup: Configure Centralized Monitoring<\/h2>\n
In the Monitoring Account<\/h3>\n
\n
\n
Deploy StackSets for Automatic Onboarding<\/h2>\n
\n
Verification: Confirm It Works<\/h2>\n
In a Source Account (e.g., Account 1)<\/h3>\n
\n
In the Monitoring Account (Central Hub)<\/h3>\n
\n
Key Benefits and Tips<\/h2>\n
\n
Wrapping Up<\/h2>\n