amazon cloudwatchlogs - Cloudtrail to Cloudwatch to other account -

i got 4 aws accounts, , want centralise logs single accounts security purposes.

meaning collect cloudwatch logs account prod, dev , perf account called logs. ideally end in cloudwatch in accounts logs, can process them elk.

i read here:

http://docs.aws.amazon.com/amazoncloudwatch/latest/logs/crossaccountsubscriptions.html

but can't find tutorial on how set whole stack.

any suggestions appreciated.

the thing different using cloudwatch logs in account credentials you'll need use.

i this; in logs account, create 3 iam users:

• prod
• dev
• perf

give each of users necessary iam permissions write logs cloudwatch logs. also, create set of aws credentials 3 users use authenticate with.

then in application, depending on stack in, configure code use relevant credentials (i.e. dev, prod) write cloudwatch logs. difference should wherever in code create cloudwatch logs client. should pass client credentials relevant iam user "logs" account.

edit:

if you're using cloudwatch logs client, idea same. create users , instead give client relevant aws credentials. specify creds user logs account in /etc/awslogs/awslogs.conf. credentials use send logs cloudwatch in other account. process need follow documented in aws docs