Export CloudWatch alarms from multiple AWS accounts into CSV

Run on Linux/Cloudshell

1. Configure AWS CLI with a profile in the Management account
2. Install JQ
3. Update the variable to the role you wish to assume in each account
4. Add the regions also to the list where you want to check for alarms

Then run this

#!/bin/bash
#User configurable variables
roletoassume="OrganizationAccountAccessRole"
regions='["eu-west-2","eu-west-1"]'
comdtorun="aws cloudwatch describe-alarms | jq -r '.MetricAlarms[] | [.AlarmName, .Namespace, .Dimensions[0].Name, .Dimensions[0].Value, .MetricName, .Statistic, .Period, .Threshold, .ComparisonOperator, .EvaluationPeriods] | @csv'"

accounts=$(aws organizations list-accounts --query "Accounts[*].Id")
masteraccount=$(aws organizations describe-organization |jq .Organization.MasterAccountId | tr -d '"')

echo $masteraccount
echo $regions | jq .[] | tr -d '"'| while read region;
                do
                        echo $region
                        eval $comdtorun
                done

echo $accounts | jq -c .[]| while read i;
do
        account=$(echo $i | tr -d '"')
        if [[ "$account" != "$masteraccount" ]]
        then
                echo $account
                sts=$(aws sts assume-role --role-arn arn:aws:iam::${account}:role/${roletoassume} --role-session-name mysession)
                var=( $(echo $sts | jq '.[] | .AccessKeyId, .SecretAccessKey, .SessionToken') )

                export AWS_ACCESS_KEY_ID=$(echo ${var[0]} | tr -d '"')
                export AWS_SECRET_ACCESS_KEY=$(echo ${var[1]} | tr -d '"')
                export AWS_SESSION_TOKEN=$(echo ${var[2]} | tr -d '"')

                echo $regions | jq .[] | tr -d '"'| while read region;
                do
                        echo $region
                        eval $comdtorun
                done

                unset AWS_ACCESS_KEY_ID
                unset AWS_SECRET_ACCESS_KEY
                unset AWS_SESSION_TOKEN

        fi
done

On top of above, you could centrally deploy from aws organisation a lambda function on each of your accounts: https://aws.amazon.com/blogs/architecture/using-devops-automation-to-deploy-lambda-apis-across-accounts-and-environments/ and extract the info as mentioned above.

The would be up to you to either send a report or send all data back to a central queue or topic for consolidation.