Which solution will meet these requirements?
Deploy an AWS CloudFormation stack set to the accounts in the organization. Use a template that creates the required Amazon CloudWatch alarms and references an Amazon Simple Notification Service (Amazon SNS) topic in the logging account with publish permissions for all the accounts.
Deploy an AWS CloudFormation stack in each account. Use the stack to deploy the required Amazon CloudWalch alarms and the required Amazon Simple Notification Service (Amazon SNS) topic.
Deploy an AWS Lambda function on a cron job in each account. Configure the Lambda function to read resources that are in the account and to invoke an Amazon Simple Notification Service (Amazon SNS) topic if any metrics cross the defined threshold.
Deploy an AWS CloudFormation change set to the organization. Use a template to create the required Amazon CloudWatch alarms and to send alerts to a verified Amazon Simple Email Service (Amazon SES) identity.
Explanations:
This solution meets the requirements by using a CloudFormation stack set to deploy Amazon CloudWatch alarms across all accounts within the organization, pointing to a centralized SNS topic in the logging account. The publish permissions allow each account to send alerts centrally, meeting the alerting requirement effectively.
Deploying a separate CloudFormation stack in each account creates unnecessary complexity and management overhead, as each account would have its own SNS topic. This is not a centralized solution and does not leverage AWS Organizations efficiently.
Using Lambda functions on a cron job in each account adds additional management complexity and cost. This solution does not directly address the centralized alerting requirement, as it requires custom logic in each account rather than using CloudWatch alarms and SNS across the organization.
Deploying a CloudFormation change set to the organization with Amazon SES as the notification mechanism does not leverage SNS for centralized alerting. Additionally, Amazon SES verification processes and rate limits make it less suitable for real-time alerting across accounts.
From my point of view, the answer is:
Deploy an AWS CloudFormation stack set to the accounts in the organization. Use a template that creates the required Amazon CloudWatch alarms and references an Amazon Simple Notification Service (Amazon SNS) topic in the logging account with publish permissions for all the accounts.
I infer that the answer is:
Deploy an AWS CloudFormation stack set to the accounts in the organization. Use a template that creates the required Amazon CloudWatch alarms and references an Amazon Simple Notification Service (Amazon SNS) topic in the logging account with publish permissions for all the accounts.