# Ensure CloudWatch has allowed cross-account sharing

- Source: https://support.icompaas.com/support/solutions/articles/62000223804-ensure-cloudwatch-has-allowed-cross-account-sharing
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**  

CloudWatch is a monitoring and management service that provides data and actionable insights for AWS, hybrid, and on-premises applications and infrastructure resources. Cloudwatch  cross-account functionality to your CloudWatch console. This functionality provides you with cross-account visibility to your dashboards, alarms, metrics, and automatic dashboards without having to log in and log out of different accounts.

  

**Rationale:**

Amazon CloudWatch dashboards are customizable home pages in the CloudWatch console that you can use to monitor your resources in a single view, even those resources that are spread across different Regions. You can use CloudWatch dashboards to create customized views of the metrics and alarms for your AWS resources.

  

**Impact:**

Enabling cross-account sharing gives the monitoring account access to your sharing accounts data.

  

**Default Value:**

By default, AWS doesn’t allow accessing the AWS services data between AWS accounts, even when they belong to the same organization.

  

**Pre-Requisite:**

-   You must know the [Account ID](https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html "https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html") of each of your AWS accounts.
    

  

**Remediation:**

**Test Plan:**

1.  Sign in to the AWS Management Console
    
2.  Open the CloudWatch console at [https://console.aws.amazon.com/cloudwat](https://console.aws.amazon.com/cloudwatch)[c](https://console.aws.amazon.com/cloudwatch)[h](https://console.aws.amazon.com/cloudwatch).
    
3.  Go to CloudWatch and check the left side panel for Settings. Click on Settings.![](https://support.icompaas.com/assets/kb/7fb6aa245cff3664.png)
    
4.  On the Cloudwatch setting dashboard, you can see whether cross-account sharing is enabled or not. ![](https://support.icompaas.com/assets/kb/b653c053a088be6a.png) 
    
5.  Here you can see that Cross-account sharing is not configured. 
    

  

  

**Implementation:** 

To enable your account to view cross-account cross-Region CloudWatch data

1.  Open the CloudWatch console at [h](https://console.aws.amazon.com/cloudwatch/ "https://console.aws.amazon.com/cloudwatch/")[t](https://console.aws.amazon.com/cloudwatch/ "https://console.aws.amazon.com/cloudwatch/")[tps://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/ "https://console.aws.amazon.com/cloudwatch/").
    
2.  In the navigation pane, choose **Settings**.
    
3.  On the Cloudwatch setting dashboard, you can see whether cross-account sharing is enabled or not, for enabling it then choose **Configure**. ![](https://support.icompaas.com/assets/kb/383121f6ba8dec85.png) 
    
4.  After selecting configure Scroll down under View cross-account cross-region select **Enable**.![](https://support.icompaas.com/assets/kb/0284cb328e7a0f8d.png)
5.  Under **View cross-account cross-region**, choose one of the following options:
    -   **Account Id Input**. This option prompts you to manually input an account ID each time that you want to switch accounts when you view cross-account data.
        
    -   **AWS Organization account selector**. This option causes the accounts that you specified when you completed your cross-account cross-Region integration with Organizations to appear. When you next use the console, CloudWatch displays a dropdown list of these accounts for you to select from when you are viewing cross-account data.
        
        You must have first used your organization's master account to allow CloudWatch to see a list of accounts in your organization. For more information, see [(Optional) Integrate With AWS Organizations](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Cross-Account-Cross-Region.html#cross-account-and-AWS-organizations "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Cross-Account-Cross-Region.html#cross-account-and-AWS-organizations").
        
    -   **Custom account selector**. This option prompts you to enter a list of account IDs. When you next use the console, CloudWatch displays a dropdown list of these accounts for you to select from when you are viewing cross-account data.
        
        You can also enter a label for each of these accounts to help you identify them when choosing accounts to view.
        
6.  Choose **Enable.![](https://support.icompaas.com/assets/kb/bf36f029fe80b150.png)**

  

  

**Backout Plan:**

1.  Log in to your monitoring account, and Navigate to the [IAM console](https://console.aws.amazon.com/iam/ "https://console.aws.amazon.com/iam/").
    
2.   Click **Roles** under the **Access management** section, next on the list of roles.![](https://support.icompaas.com/assets/kb/c9f969fdbacad923.png)
    
3.  Check the **CloudWatch**–**CrossAccountSharingRole** role, select that role, and click **Delete role**. ![](https://support.icompaas.com/assets/kb/5d8c2331b273340e.png) 
    
4.  At the next prompt, confirm the deletion by clicking on the **Yes, delete** button ![](https://support.icompaas.com/assets/kb/2240e19c0d578d58.png) 
    

  

#### Reference:

[![](https://support.icompaas.com/assets/kb/593ebab52689ba72.png)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Cross-Account-Cross-Region.html)[Cross-account cross-Region CloudWatch console - Amazon CloudWatch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Cross-Account-Cross-Region.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.