Grafana Learn
Sign in Sign up
Path

Select the Grafana Assume Role authentication method and set the default AWS region for the data source.

Estimated time: 1 min

Configure authentication and region

On the CloudWatch Settings tab, you choose how Grafana authenticates to AWS and which region it queries. This path uses Grafana Assume Role, a keyless method available in Grafana Cloud that lets Grafana access your AWS account through a trusted IAM role instead of long-lived access keys.

In Grafana Cloud, the Authentication Provider offers two options: Grafana Assume Role and Access & secret key. Grafana Assume Role is usually preselected.

  1. Under Authentication > Authentication Provider, make sure Grafana Assume Role is selected.

    This is the recommended method for Grafana Cloud — it avoids storing AWS access keys in Grafana.

  2. Under Additional Settings > Default Region, select the AWS region where your CloudWatch data lives, such as us-east-1.

    This is the region Grafana queries unless you override it in an individual panel.

Leave the Settings tab open. In the next milestone, you’ll create the IAM role in AWS that Grafana Assume Role relies on and paste its ARN here.