AWS DevOps Engineer Professional Practice Test

Is it necessary for all accounts sending CloudWatch Events to a master account to be part of the same AWS Organization?

1. Yes, it is required for compliance

2. No, permissions can be set individually

3. Yes, it ensures centralized logging

4. No, but they should share the same region

The correct answer is: No, permissions can be set individually

The assertion that permissions can be set individually is correct because AWS allows for flexible permission management across accounts, regardless of whether they are part of the same AWS Organization. Each account can have its own IAM (Identity and Access Management) policies that specify which resources can send CloudWatch Events to a central or master account. This highlights AWS's design that permits independent account management while still enabling cross-account communication and event management. Organizations can use IAM roles and resource policies to grant appropriate permissions to send events, allowing different accounts to operate cohesively without needing to be linked under the same organizational umbrella. The other options here relate to various aspects of AWS Organizations and event handling but do not accurately reflect how CloudWatch Events can be managed across accounts. For instance, compliance needs may vary per organization, centralized logging capabilities might be more efficient when using the same organization, and geographical constraints could affect performance, but none of these points are requirements for the functionality regarding CloudWatch Events specifically.