Log data from 50 accounts must stream into one central logging account's S3 data lake in near-real-time. What's the architecture?
A.Each account exports logs to its own S3, central crawls them
Per-account buckets with periodic crawling is slower and fragmented.
B.CloudWatch subscription filters → Kinesis Data Streams/Firehose in the central account → S3
Subscription filters + central Firehose. Correct.
C.Scheduled S3 replication per account
Scheduled replication has replication lag — not near-real-time streaming.
D.CloudWatch cross-account dashboards
Dashboards are visualization — no data centralization.
Why this answer
The canonical pattern: log subscription filters on each account's CloudWatch log groups stream to a destination (Kinesis/Firehose) in the central account → lands in the S3 lake. Dashboards view metrics — they don't centralize log DATA.
Correct answer: B · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Multi-Account Architecture practice session.
Practice Multi-Account Architecture