CloudWatch centralizes multi-account logs without a homegrown pipeline
On 16 October 2026, CloudWatch log centralization expanded to both GovCloud regions and 13 more commercial regions, bringing the covered total to fifteen. For organizations already on AWS Organizations, that is the signal to weigh your homegrown log pipeline against a native feature priced at $0.05 per gigabyte beyond the first copy.
16 October 2026. AWS extends CloudWatch log centralization to both GovCloud (US) regions and 13 more commercial regions. March 2026. The feature first landed with rule-driven multi-account, multi-region log copying. 16 October 2026, again. The first copy stays free; additional copies cost $0.05/GB. Why it matters: centralizing logs is no longer an engineering project — it is a configuration rule, and the cost is now predictable enough to discuss in a FinOps review.
What centralization actually does
CloudWatch centralization copies logs from multiple accounts and multiple regions into a single destination account. It leans on AWS Organizations to aggregate logs without a custom pipeline: no more maintaining a Kinesis stream, a shipper Lambda, and an intermediate bucket that each add a point of failure. The service itself moves the data.
Scope is set through centralization rules, which you can target at the entire organization, a specific organizational unit, or selected accounts. That is the right level of granularity: a security team can capture every log, while a business unit keeps its own isolated. Source context survives through enriched system fields — you know where each event came from once it lands in the central account, something a homegrown shipper often loses by flattening metadata on the way.
The feature also collapses the “who can read what” problem. Instead of duplicating IAM roles in every account to read logs, the operations team reads from the central account. The access surface shrinks to one point, and the audit trail becomes unambiguous.
Adoption still demands a few deliberate choices. You have to designate the destination account, attach retention and lifecycle policies to it, and set the rule scope — whole organization, per OU, or per account — before turning anything on. A rule that is too broad floods the central account with logs nobody reads and quietly drives up the $0.05/GB bill; a rule scoped too tightly leaves gaps that security notices only after an incident. The destination account, once chosen, becomes the single pane your SIEM, audit, and compliance tools should point at — which means it inherits their access requirements and becomes, in effect, a second crown-jewel account you must protect as carefully as the workloads whose logs it holds.
The cost: first copy free, then $0.05/GB
The pricing is the most legible part of the announcement, and that is rare. AWS charges $0.05/GB for each copy beyond the first free copy. In other words: if your logs stay in their home account and you make a single central copy, centralization costs you nothing in volume. The bill only appears once you multiply copies — one for security, one for FinOps, one for compliance.
That model changes the architecture decision. Historically, centralizing logs meant paying twice: once for ingestion (the pipeline) and once for storage (the central account). Here ingestion is native and the first destination is free. The $0.05/GB marginal cost has to be weighed against VPC Flow Logs or CloudTrail from a large organization, which can run to terabytes per month: the question is no longer “what does the pipeline cost,” but “how many copies do we actually want.”
What it replaces
Until now, multi-account centralization was built by hand. You put a PutSubscriptionFilter subscription on each log group, a Lambda or a Firehose agent to push into an S3 bucket, then a consumer to replay it all into the SIEM. Every link adds maintenance cost, loss risk, and an in-transit encryption question. CloudWatch centralization collapses those three tiers into a single declared rule.
Creating a rule via the AWS CLI is one command:
aws logs put-centralization-rule \
--rule-name all-accounts \
--scope organization \
--destination-arn arn:aws:logs:eu-west-1:111122223333:destination:centralThe rule applies to the whole organization, and logs converge on the destination account with no Lambda running. What was a team project becomes a line in an IaC pipeline, versioned and reviewed like the rest of the infrastructure.
The cost math takes two minutes. An organization centralizing CloudTrail and VPC Flow Logs at 10 TB/month pays nothing for its first copy. If it adds a second — a security copy separate from the FinOps copy — the bill rises to $500/month (10 TB × $0.05/GB). The number is small enough to absorb and concrete enough to budget: it is the predictability that homegrown pipelines lacked, where the real cost hid inside engineering hours.
The 16 October expansion
The 16 October announcement extends the feature to 13 commercial regions and both GovCloud regions. The new commercial regions cover Cape Town, Hong Kong, Hyderabad, Jakarta, Malaysia, Melbourne, Calgary, Milan, Spain, Zurich, Tel Aviv, Bahrain, and the UAE. For GovCloud customers, it means workloads subject to data residency requirements can finally centralize logs within the government partition, separate from the commercial one — a compliance detail that frequently blocks federal deployments.
The geography is not incidental: the added Asia-Pacific and Middle East regions are precisely where multi-account organizations run regional workloads and previously had to ship logs back to a distant region, with the latency and locality constraints that implies. Local centralization removes that brake.
What centralization does not solve
Let us bound the scope, because the temptation is to read it as broader than it is. CloudWatch centralization is single-cloud: it aggregates AWS logs, not those from GCP, Azure, or your on-premise servers. A multi-cloud strategy still needs a SIEM or third-party collector downstream. It also does not do detection or correlation: it moves and copies logs, it does not interpret them. Alerting on an anomalous sequence of events remains the job of the tool that consumes the central account.
Retention also stays your responsibility. Centralized logs obey the lifecycle policies of the destination log group: without an expiration rule, the central account accumulates volume — and therefore cost — without limit. Finally, in-transit encryption is handled by the service, but access to the destination account remains yours to control: an overly broad IAM role that can read the central account hands the keys to the log vault to the whole organization. Centralizing logs does not, by magic, centralize their governance.
Verdict
If your organization already runs on AWS Organizations and you maintain a homegrown log pipeline, do the math: the cost of your shipper — development, maintenance, outages — against a free first copy and $0.05/GB after that. For most estates, the native feature wins. If you need multiple copies — security, compliance, internal chargeback — budget each extra copy explicitly rather than duplicating by reflex. If you already aggregate into a SIEM or OpenSearch, centralization does not replace it: it becomes the collection layer that feeds those tools, removing the plumbing in between. CloudWatch centralization does not do a SIEM’s job; it does the job your engineers should never have had to do themselves.