2 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
AWS has upgraded CloudWatch to consolidate operational, security, and compliance logs from multiple accounts and sources into a unified platform. The new features support querying logs directly in Amazon S3 without ETL, making it easier for organizations to manage their log data while reducing costs and complexity. However, there are concerns about vendor lock-in as it ties users closely to the AWS ecosystem.
If you do, here's more
AWS has upgraded Amazon CloudWatch, transforming it into a unified observability platform that consolidates operational, security, and compliance logs across multiple accounts. This move addresses a common pain point for enterprises: the complexity and cost of managing fragmented logs with various tools. The new features allow organizations to access log data via Apache Iceberg-compatible tables in Amazon S3, enabling in-place queries without needing ETL pipelines. This integration supports standards like Open Cybersecurity Schema Framework (OCSF) and Open Telemetry (OTel), positioning CloudWatch as a strong contender against established platforms like Splunk and Datadog, particularly for AWS-focused companies.
The enhanced CloudWatch now aggregates logs from AWS services such as CloudTrail and VPC Flow Logs, as well as third-party sources like CrowdStrike and Microsoft Office 365. It simplifies log management by combining data into a single service with built-in governance, which reduces the need for multiple copies and lowers operational costs. Users can query logs using natural language or popular query languages like LogsQL and SQL. The new Facets interface enhances usability by allowing intuitive filtering of logs by various parameters, facilitating cross-account and cross-region queries.
Despite these advancements, some industry observers express skepticism. Corey Quinn, for instance, pointed out that while CloudWatch has adopted features akin to those of Splunk from years ago, it may be burdened by excessive AWS service names rather than substantive new capabilities. AWS is banking on its native integration and a "Zero-ETL" model to attract AWS-centric organizations, even as competitors like Datadog and Dynatrace offer more sophisticated Application Performance Monitoring tools. Open-source solutions like the ELK stack provide vendor independence but require more infrastructure management, which CloudWatch's managed service approach seeks to alleviate while also creating tighter ties to the AWS ecosystem. The new features are available in all AWS regions except GovCloud and China, with pricing available on the AWS pricing page.
Questions about this article
No questions yet.