Aggregate telemetry across accounts and trace requests using CloudWatch cross-account observability, AWS X-Ray, Amazon Data Firehose and log subscription filters.

A company runs around forty AWS accounts under AWS Organizations, and each account writes application logs to its own Amazon CloudWatch Logs groups. The platform team needs all of these logs to flow continuously into a single logging account where they are indexed for search, and they want a near real-time, push-based mechanism that scales as new accounts and log groups appear. Which design meets this requirement with the least custom code?

• ASchedule a Lambda function in every account to call the CloudWatch Logs GetLogEvents API on a timer and write the retrieved events into an Amazon S3 bucket owned by the central logging account.
• BExport each log group to Amazon S3 with a daily CloudWatch Logs export task in every account and copy the resulting objects into the central logging account for later indexing.
• CTurn on AWS CloudTrail organisation logging so every account delivers its CloudWatch Logs data to a central trail bucket that the logging account then indexes for full-text search.
• DCreate CloudWatch Logs subscription filters in each account that send matching events to an Amazon Kinesis Data Streams destination in the central logging account, where a consumer indexes the events for search.check_circle Correct

Why A is wrong: Polling GetLogEvents on a timer is custom code in every account, it lags behind real time, and tracking read positions across many log groups is brittle compared with the push-based subscription mechanism.

Why B is wrong: Log group export tasks are batch operations meant for archival and run on a schedule measured in hours, so they cannot satisfy the stated near real-time, continuous flow requirement.

Why C is wrong: CloudTrail records AWS API activity, not arbitrary application log content in CloudWatch Logs, so it captures the wrong data entirely and would not aggregate the application logs the team needs.

Why D is correct: Subscription filters push log events to a cross-account Kinesis destination in near real time and scale automatically as log groups are added, which is the native, low-code pattern for centralising CloudWatch Logs across accounts.