Everything user specific. Nothing should operate across users. Why should it anyway. You only need to aggregate logs across users, cloud watch does this.