Grafana Learn
Sign in Sign up
Path

Learn how to create the required AWS IAM role and policies to allow Grafana Cloud to access your AWS metrics.

Estimated time: 2 min

Create an AWS IAM role

In this milestone, you’ll create an AWS IAM role that grants Grafana Cloud the necessary permissions to collect metrics from your AWS account. This role uses the principle of least privilege, providing only the read-only access required for monitoring.

The IAM role establishes a secure trust relationship between your AWS account and Grafana Cloud, allowing metric collection without sharing long-term credentials or compromising security.

You can configure the AWS role automatically with CloudFormation or Terraform, or manually in the AWS Management Console. This milestone uses CloudFormation, the recommended approach.

  1. From the Configuration tab, click the AWS accounts tile.

  2. On the AWS accounts page, click Add new account to open the Create new account page.

  3. For Create a new AWS role, leave the Automatically and Use CloudFormation tiles selected.

  4. Click Launch stack to open a CloudFormation template in your AWS account in a new tab.

    The AWS account you’re logged into when you click this button is the account that opens. To use a different account, log out of the current account and log in to the account you want to use.

Complete the remaining steps in the AWS console tab, then return to Grafana Cloud:

  1. Select the I acknowledge that AWS CloudFormation might create IAM resources with custom names checkbox.
  2. Click Create stack.
  3. Copy the RoleARN in the Outputs tab of the stack to use in the next milestone.
  4. Return to the Create new account page in Grafana Cloud when you have finished in AWS.

You created a read-only AWS IAM role and copied its role ARN for the next milestone.

In your next milestone, you’ll use this IAM role to connect your AWS account to Grafana Cloud.

More to explore (optional)