Grafana Learn
Sign in Sign up
Path

Create an IAM role in AWS that trusts Grafana and paste its ARN into the data source configuration.

Estimated time: 2 min

Set up the Grafana Assume Role

With Grafana Assume Role selected, Grafana Cloud makes a Security Token Service (STS) request to generate temporary credentials for your AWS account. You create an IAM role that trusts Grafana’s AWS account, and Grafana assumes that role to read your CloudWatch data. No access keys are stored in Grafana.

On the CloudWatch Settings tab, under the Assume Role heading, expand How to create an IAM role for grafana to assume to reveal the Grafana account ID and External ID unique to your instance. You’ll enter both in the AWS Console. Select Learn more about Grafana Assume Role for the full reference.

Create the IAM role in AWS

In a separate browser tab, open the AWS IAM console and complete the following steps:

  1. Create a new IAM role. Under Trusted entity type, select Another AWS account.
  2. Enter the Grafana account ID from the Settings tab, and select Require external ID.
  3. Enter the External ID from the Settings tab.
  4. Attach the metrics, logs, or metrics-and-logs permissions policy you prepared earlier.
  5. Give the role a name and description, then select Create role.
  6. Open the new role and copy its ARN (for example, arn:aws:iam::123456789012:role/grafana-cloudwatch).

For full details and a sample trust relationship, refer to Use Grafana Assume Role.

Back on the CloudWatch Settings tab, paste the role ARN you copied into the Assume Role ARN field.

In the next milestone, you’ll save the data source and test the connection to AWS.