We are looking to implement this solution for centralized CloudWatch Logs. However, in implementing the solution it doesn't specify if the Log Archive account created with Control Tower should be used, or if a separate account should be created for centralized logging. I can not find any guidance on if this would implementing this in the Log Archive account would be a best practice or not
https://aws.amazon.com/solutions/implementations/centralized-logging/
based on the AWS Security Reference Architecture documentation (go to page), it is ok to consolidate operational and application data into the Log Archive account. From the docs
Operational log data used by your infrastructure, operations, and workload teams often overlaps with the log data used by security, audit, and compliance teams. We recommend that you consolidate your operational log data into the Log Archive account.
and also
The primary logs shown in the AWS SRA include CloudTrail (organization trail), Amazon VPC flow logs, access logs from Amazon CloudFront and AWS WAF, and DNS logs from Amazon Route 53. These logs provide an audit of actions taken (or attempted) by a user, role, AWS service, or network entity (identified, for example, by an IP address). Other log types (for example, application logs or database logs) can be captured and archived as well.
