Grafana Learn
Sign in Sign up
Path

Gather the AWS IAM permissions Grafana needs to read CloudWatch metrics and logs before you add the data source.

Estimated time: 2 min

Prepare AWS permissions

Grafana makes requests to AWS on behalf of an IAM role or IAM user. That identity must have policies that allow the CloudWatch and EC2 API actions Grafana uses. In this milestone, you gather the permissions Grafana needs before you configure the data source.

This path uses the Grafana Assume Role authentication method, which is available in Grafana Cloud for the CloudWatch data source. With Grafana Assume Role, you don’t create or rotate access keys — instead, you create an IAM role that trusts Grafana’s AWS account and attach the permissions below to that role. You’ll create the role itself in a later milestone.

Choose the permissions you need

Attach one of the following policies to the IAM role, depending on what you plan to query:

  • Metrics only — read CloudWatch metrics plus EC2 tags, instances, and regions.
  • Logs only — read CloudWatch Logs plus EC2 tags, instances, and regions.
  • Metrics and logs — read both.

The metrics-and-logs policy is shown below. For the metrics-only and logs-only variants and the cross-account observability policy, refer to Configure the CloudWatch data source.

Metrics and logs permissions:

JSON 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowReadingMetricsFromCloudWatch",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:DescribeAlarmsForMetric",
        "cloudwatch:DescribeAlarmHistory",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:ListMetrics",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetInsightRuleReport"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowReadingResourceMetricsFromPerformanceInsights",
      "Effect": "Allow",
      "Action": "pi:GetResourceMetrics",
      "Resource": "*"
    },
    {
      "Sid": "AllowReadingLogsFromCloudWatch",
      "Effect": "Allow",
      "Action": [
        "logs:DescribeLogGroups",
        "logs:GetLogGroupFields",
        "logs:StartQuery",
        "logs:StopQuery",
        "logs:GetQueryResults",
        "logs:GetLogEvents"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowReadingTagsInstancesRegionsFromEC2",
      "Effect": "Allow",
      "Action": ["ec2:DescribeTags", "ec2:DescribeInstances", "ec2:DescribeRegions"],
      "Resource": "*"
    },
    {
      "Sid": "AllowReadingResourcesForTags",
      "Effect": "Allow",
      "Action": "tag:GetResources",
      "Resource": "*"
    }
  ]
}

Keep this policy handy — you’ll attach it to the IAM role you create for Grafana Assume Role.

Also note your AWS region

Grafana queries one default region per data source (for example, us-east-1 or eu-west-2). Note the region where your CloudWatch metrics and logs live — you’ll enter it when you configure the data source.

In the next milestone, you’ll add the CloudWatch data source in Grafana Cloud.