CloudWatch Metrics Insights (SQL) query fails with "Cross-region and cross-account queries are not supported" despite working OAM link

This is expected behavior. CloudWatch Metrics Insights (SQL queries) does not currently support cross-account queries, even when you have a properly configured CloudWatch cross-account observability (OAM) link in place.

While CloudWatch cross-account observability enables many cross-account capabilities including dashboards, alarms, and anomaly detection, Metrics Insights queries are not among the supported functionalities for cross-account access at this time.

Recommended Workarounds:

1. Use standard metric queries instead of SQL: For your "top 10 Lambda functions by ConcurrentExecutions" use case, you can create a dashboard widget using regular metric queries with the SEARCH function or by explicitly listing the metrics from the linked source account. Standard metric queries do support cross-account access through OAM.

2. Use CloudWatch Metrics Centralization: If you need SQL query capabilities across accounts, consider setting up cross-account metrics centralization. This feature automatically copies metrics from source accounts to a central destination account, where they become owned by the destination account. Once centralized, you can run Metrics Insights queries directly against these metrics without cross-account limitations. Note that centralization works at the AWS Organizations level and only processes new metric data after rule creation.

3. Query directly in the source account: As an alternative, you could run the Metrics Insights query directly in the source account's console and share the results or create separate dashboards in each account.

The centralization approach would be the most comprehensive solution if you need SQL query capabilities across multiple accounts, as it makes the metrics native to your monitoring account.
Sources
Cross-account cross-Region metrics centralization - Amazon CloudWatch
Monitor across accounts and Regions - Amazon CloudWatch

This actually does work; the issue is just where you're putting accountId. That field applies only to plain metric tuples, not to SQL expressions. For Metrics Insights, you need to filter the account in the query itself using a WHERE clause.

Try this instead:

`SELECT MAX(ConcurrentExecutions)
FROM SCHEMA("AWS/Lambda", FunctionName)
WHERE AWS.AccountId = '<LINKED_SOURCE_ACCOUNT_ID>'
GROUP BY FunctionName
ORDER BY MAX() DESC
LIMIT 10
`

{
  "type": "metric",
  "properties": {
    "view": "timeSeries",
    "region": "us-east-1",
    "metrics": [
      [
        {
          "expression": "SELECT MAX(ConcurrentExecutions) FROM SCHEMA(\"AWS/Lambda\", FunctionName) WHERE AWS.AccountId = '<LINKED_SOURCE_ACCOUNT_ID>' GROUP BY FunctionName ORDER BY MAX() DESC LIMIT 10",
          "id": "q1",
          "period": 300
        }
      ]
    ]
  }
}

And drop "accountId" from the widget JSON entirely; just keep expression/id/period on that metric object. That combo (expression + accountId) is what's triggering the "cross-region and cross-account queries are not supported" error.

If you want it across all your source accounts instead of just one, group by AWS.AccountId too:

SELECT MAX(ConcurrentExecutions)
FROM SCHEMA("AWS/Lambda", FunctionName)
GROUP BY FunctionName, AWS.AccountId
ORDER BY MAX() DESC
LIMIT 10

Ran into the same thing a while back, easy to miss since every other widget type does take accountId at the top level.

Replace <LINKED_SOURCE_ACCOUNT_ID> with your real 12-digit account number (keep the single quotes) in both the SQL and the JSON before you post it.