How to centrally collect CloudWatch alarms from 88 linked accounts using Cross-Account Observability?

Question

Hello AWS Community,

We have a multi-account AWS environment (88 tenant accounts) managed under AWS Organizations. We have configured CloudWatch Cross-Account Observability using:
 1. Sink in the central monitoring account
 2. Link in all tenant accounts
 3. Sync policy enabled

From the central monitoring account, we are successfully able to:
1. View metrics across all linked accounts
2. View logs across accounts
3. Confirm EC2/RDS metrics from tenant accounts are publishing correctly

However, we would now like to:

Collect an inventory of all existing CloudWatch alarms configured in the tenant accounts from the central monitoring account.

Our goal is to:

1.List all alarms across the 88 accounts
2.Export them (CSV/Excel) for governance and audit reference
3.Identify accounts that may not have required alarms configured

My understanding is that Cross-Account Observability shares metrics, logs, and traces — but not alarm resources themselves.

So my questions are:

Is it possible to centrally list or export CloudWatch alarms across linked accounts directly using Cross-Account Observability?

If not, what is the recommended enterprise approach to build a centralized alarm inventory?

AssumeRole into each account and run describe-alarms? Use AWS Config Aggregator?
Any managed solution available?

Is there any AWS-native governance pattern for centrally auditing alarm coverage across accounts?

We are looking for a scalable and governance-friendly approach.

Thank you in advance.

re:Post Agent · Answer

You are correct in your understanding. CloudWatch Cross-Account Observability is designed to share metrics, logs, and traces between source accounts and monitoring accounts, but it does not centrally collect or display alarm resources themselves from the linked accounts.

However, you can create alarms in your monitoring account that watch metrics from your source accounts. This means you would need to recreate or define alarms in the central monitoring account based on the metrics being shared from your 88 tenant accounts, rather than viewing the existing alarms configured in those source accounts.

For your specific use case of collecting an inventory of existing CloudWatch alarms across all tenant accounts for governance and audit purposes, Cross-Account Observability alone will not provide this capability. You would need to implement an alternative approach to gather this alarm inventory.

While the sources provided don't detail specific methods for centralized alarm inventory collection, the Cross-Account Observability feature focuses on enabling you to monitor and create alarms in the monitoring account based on shared telemetry data, rather than aggregating existing alarm configurations from source accounts.

For building a centralized alarm inventory across your 88 accounts, you would need to look beyond Cross-Account Observability to other AWS services or custom solutions that can programmatically collect alarm configurations from multiple accounts, though specific recommendations for those approaches are not covered in the available documentation about Cross-Account Observability.  
**Sources**  
[Monitor across accounts and Regions - Amazon CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Cross-Account-Methods.html)  
[Using Amazon CloudWatch dashboards - Amazon CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html)

How to centrally collect CloudWatch alarms from 88 linked accounts using Cross-Account Observability?

Add your answer

Relevant content