AMAZON BEDROCK / ARCHITECTURE C04 / GOVERNANCE

GOVERNANCE AT ORG SCALEPRACTICAL

CHAPTER 35 / 36
TOPIC see every account's agents from one place
REV 2026.07

IN PLAIN WORDS

You will set up one central account that can see the agent traces and metrics from every other account. AWS calls this cross-account observability: the central account makes a sink, each team account makes a link to it, then one console shows everything. Terms: monitoring account = the central one; source account = a team's account; OAM = Observability Access Manager (the sink/link plumbing); StackSets = deploy one template to many accounts at once.

[ 1 ] IN THE MONITORING ACCOUNT, CREATE A SINK (accepts telemetry org-wide)

# CloudFormation, in the central monitoring account
Resources:
  ObservabilitySink:
    Type: AWS::Oam::Sink
    Properties:
      Name: AgentCoreObservabilitySink
      Policy:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal: '*'
            Action: ['oam:CreateLink', 'oam:UpdateLink']
            Resource: '*'
            Condition:
              StringEquals: { aws:PrincipalOrgID: '<your-org-id>' }   # all accounts in your org
              ForAllValues:StringEquals:
                oam:ResourceTypes: ['AWS::Logs::LogGroup', 'AWS::CloudWatch::Metric']
Outputs:
  SinkArn: { Value: !GetAtt ObservabilitySink.Arn }   # share this ARN with source accounts

[ 2 ] IN EACH SOURCE ACCOUNT, CREATE A LINK (roll out with StackSets)

# CloudFormation, in every team (source) account
Resources:
  ObservabilityLink:
    Type: AWS::Oam::Link
    Properties:
      LabelTemplate: '$AccountName'
      ResourceTypes: ['AWS::Logs::LogGroup',
                      'AWS::CloudWatch::Metric']
      SinkIdentifier: '<sink-arn-from-monitoring-account>'

ROLL IT OUT

Deploy this link to all member accounts at once with AWS CloudFormation StackSets. Linking through AWS Organizations also onboards new accounts automatically. Each source account needs its own observability on (Transaction Search + Metrics and Logs).

[ 3 ] VIEW EVERYTHING IN THE MONITORING ACCOUNT

Open the AgentCore Observability console in the monitoring account: it automatically shows agents, sessions, traces, and metrics from every linked account. Filter the sessions and traces tables by Account ID to focus on one team.

Limits: cross-account observability is per Region (monitoring and source accounts must be in the same Region); both must have Metrics and Logs enabled; data is only visible while the OAM link is active. Pair this with an organization CloudTrail and cost-allocation tags for full audit and per-team cost.

SRC: AWS AgentCore Developer Guide (monitor AgentCore resources across accounts) + CloudWatch OAM. Concept: chapter 34.

DRAWN 2026.06, REV 2026.07.26