Test the connection

Now that you’ve selected an authentication method, set your region, and configured the Assume Role ARN, save the data source and verify that Grafana can reach AWS.

Click Save & test at the bottom of the Settings tab.

Grafana assumes the IAM role and makes a test request to CloudWatch. On success, you’ll see a confirmation message that the data source is working.

Common connection issues

If Save & test fails, the message usually points to one of these causes:

• Access denied or not authorized to perform: sts:AssumeRole — The trust relationship, role ARN, or external ID is off. Confirm the role trusts the Grafana account ID, requires the exact External ID from the instructions box, and that you pasted the correct role ARN.
• User is not authorized to perform: cloudwatch:ListMetrics — The IAM policy is missing required actions. Attach the metrics/logs permissions policy from the earlier milestone to the role.
• The security token included in the request is invalid — Credentials are invalid, expired, or rotated, or a transient Grafana Cloud incident is in progress. Re-save the data source to refresh credentials, and check the Grafana Cloud status page if several data sources fail at once.
• No data but no error — The region is likely wrong. Confirm the Default Region matches where your metrics and logs live.

To troubleshoot further, refer to Troubleshoot CloudWatch issues.

In the next milestone, you’ll run a query and explore your CloudWatch data in Grafana.