An application runs in four Regions and the security team needs one place to query all of its logs. Which architecture avoids copying data between Regions?
Show answer and explanation
Answer: D
CloudWatch cross-account observability links source accounts and Regions to a monitoring account, and Logs Insights in that account can query the shared log groups directly regardless of where they live. Analysts get a single query surface without building replication pipelines or paying for duplicate storage, and the source accounts keep ownership of their data and permissions. Access is granted through the observability configuration rather than by loosening each log group policy.
Why the other options are wrong
- A. Copying every log group into every Region multiplies storage and ingestion cost and still leaves four separate query surfaces.
- B. Exporting to S3 and downloading archives is batch-oriented, so the team loses interactive query and near-real-time investigation.
- C. Emailing log attachments is not central analysis; it is manual distribution with no query capability and poor security.
Exam tip. Cross-account observability is the managed way to query logs across accounts and Regions from one console.