Setting Multi-Account Log Aggregation

Background

• Corporate groups often use Landing Zone, a multi-account solution that allows business departments to use different accounts, to enhance security by isolating permissions and resources.
• Their security compliance departments expect to collect logs centrally, and aggregate key logs of different accounts of each business department into one log account for centralized storage and analysis to meet the security compliance audit requirements of different countries and regions.
• To meet operations analysis requirements, their operations departments may also expect to aggregate key logs of different accounts of each business department into one log account for centralized storage and analysis, to facilitate unified big data processing and visual display.

Solution

• The Organizations service helps you govern multiple accounts within your organization. It enables you to consolidate multiple Huawei Cloud accounts into an organization that you create and centrally manage these accounts. You can use Service Control Policies (SCPs) to control the maximum available permissions for all accounts in your organization. This helps you better meet the service security and compliance requirements of your business.
• LTS provides the multi-account log center based on Organizations. You can log in to Organizations using the management account and specify a member account in your organization as the delegated administrator account of the trusted service LTS, and then go to the LTS console to copy the log streams of another member account to the management or delegated administrator account. In this way, logs of multiple accounts are aggregated into one account.
• The target log groups or streams are generated by copying the source log groups or streams from a member account to the management or delegated administrator account. Therefore, they do not interfere with the source log groups or streams of the member account. You can configure transfer, consumption, and processing tasks for them separately.

Prerequisites

• An organization has been created. For details, see Creating an Organization.
• LTS has been set as a trusted service. For details, see Enabling or Disabling a Trusted Service.
• The management or delegated administrator account has been granted the read-only permission on the Organizations service. For details about delegated account operations, see Specifying, Viewing, or Removing a Delegated Administrator. For details about how to grant permissions, see Creating an IAM User and Granting Organizations Permissions.

Setting a Multi-Account Log Aggregation Task

1. Log in to the console using the management or delegated administrator account and choose Log Tank Service in the navigation pane. The Log Management page is displayed.
2. Click Multi-Account Log Center under Log Applications.
3. On the displayed page, enable Log receiving status, select a member account on the left, and select its source log groups or streams on the right. You can also customize the names of the target log groups or streams.
   

   • To stop using multi-account log aggregation, simply disable Log receiving status. In this case, all aggregation settings become invalid, and logs in the source log streams stop being aggregated to the target log streams.
   • The number of log streams to be created cannot exceed the limit. For details, see the constraints described in Basic Resources.

4. Click OK. It takes about 5 minutes to create the aggregation settings for the account. Refresh the page later to view the settings.
   

   • By default, a target log stream is initialized using the index and structuring configurations of the log stream of the source account. After the aggregation is configured, subsequent index and structuring configuration changes of the source will not be synchronized to the target.
   • Deleting the log groups or streams of the source account does not affect their target equivalents.
   • After you deselect a log group or stream in Aggregation Settings and click OK, its logs will not be aggregated to the target log group or stream.