Documentation Plugins Amazon Managed Service for Prometheus Configure

Configure the Amazon Managed Service for Prometheus data source

This document explains how to configure the Amazon Managed Service for Prometheus data source and covers AWS SigV4 authentication, data source settings, and provisioning.

Before you begin

Before you configure the data source, ensure you have:

• Grafana permissions: The organization administrator role to add and configure data sources.
• An Amazon Managed Service for Prometheus workspace: Including its query endpoint URL, which ends in /api/v1/query.
• AWS credentials: An IAM identity or role with permission to query the workspace, such as aps:QueryMetrics, aps:GetLabels, aps:GetSeries, and aps:GetMetricMetadata.

Key concepts

If you’re new to Amazon Managed Service for Prometheus or AWS authentication, these terms are used throughout the configuration:

Add the data source

To add the data source:

1. Click Connections in the left-side menu.
2. Click Add new connection.
3. Type Amazon Managed Service for Prometheus in the search bar.
4. Select Amazon Managed Service for Prometheus.
5. Click Add new data source.

Configure settings

Use the following settings to identify the data source and set its endpoint.

Authentication

The Amazon Managed Service for Prometheus data source authenticates with AWS SigV4. Unlike the core Prometheus data source, SigV4 is the only authentication method, and Grafana signs every request to the workspace.

SigV4 authentication

Select an authentication provider in the Authentication Provider drop-down, then complete the fields for the provider you choose.

The providers available in the drop-down depend on your Grafana version and the allowed_auth_providers setting in the Grafana configuration file.

Depending on the provider you select, configure the following fields:

Private data source connect

The data source supports Private data source connect (PDC), which lets Grafana Cloud query an Amazon Managed Service for Prometheus workspace that isn’t exposed to the public internet, such as a workspace reached through a VPC endpoint.

To use PDC with this data source:

1. Set up a PDC connection. Refer to Configure Private data source connect.
2. On the data source configuration page, expand Secure Socks Proxy and select the PDC connection.
3. Click Save & test to verify connectivity through the private network.

Additional settings

Expand Advanced settings to configure optional behavior. These settings are shared with the core Prometheus data source.

Verify the connection

To verify the connection, click Save & test. When the configuration is valid, Grafana displays a success message such as Successfully queried the Prometheus API. If the test fails, refer to Troubleshooting.

Provision the data source

You can define and configure the data source in code so it’s reproducible across environments. This section covers provisioning with a Grafana YAML file and with Terraform.

Provision with a YAML file

You can define the data source in YAML files as part of Grafana’s provisioning system. For more information, refer to Provisioning Grafana.

The following example provisions the data source with the Access & secret key provider:

YAML Copy

apiVersion: 1

datasources:
  - name: Amazon Managed Service for Prometheus
    uid: grafana-amazonprometheus
    type: grafana-amazonprometheus-datasource
    access: proxy
    url: https://aps-workspaces.<REGION>.amazonaws.com/workspaces/<WORKSPACE_ID>
    editable: true
    jsonData:
      httpMethod: POST
      sigV4Auth: true
      sigV4AuthType: keys
      sigV4Region: <REGION>
      sigv4Service: aps
      defaultEditor: builder
      manageAlerts: true
    secureJsonData:
      sigV4AccessKey: <ACCESS_KEY_ID>
      sigV4SecretKey: <SECRET_ACCESS_KEY>

To assume an IAM role, set sigV4AuthType to the base provider you want to use, such as default or ec2_iam_role, and add assumeRoleArn and externalId instead of the access keys. For the Grafana Assume Role provider, set sigV4AuthType to grafana_assume_role:

YAML Copy

apiVersion: 1

datasources:
  - name: Amazon Managed Service for Prometheus
    type: grafana-amazonprometheus-datasource
    access: proxy
    url: https://aps-workspaces.<REGION>.amazonaws.com/workspaces/<WORKSPACE_ID>
    jsonData:
      sigV4Auth: true
      sigV4AuthType: default
      sigV4Region: <REGION>
      sigv4Service: aps
      assumeRoleArn: arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>
      externalId: <EXTERNAL_ID>

Replace the placeholder values:

• <REGION>: The AWS region of your workspace, for example us-east-1.
• <WORKSPACE_ID>: The ID of your Amazon Managed Service for Prometheus workspace.
• <ACCESS_KEY_ID> and <SECRET_ACCESS_KEY>: AWS credentials for the Access & secret key provider.
• <ACCOUNT_ID>, <ROLE_NAME>, and <EXTERNAL_ID>: The values for the role you want Grafana to assume.

Provision with Terraform

You can manage the data source with the Grafana Terraform provider using the grafana_data_source resource. Store secrets such as AWS keys in Terraform variables or a secrets manager rather than in plain text.

The following example provisions the data source with the Access & secret key provider:

hcl Copy

resource "grafana_data_source" "amazonprometheus" {
  type = "grafana-amazonprometheus-datasource"
  name = "Amazon Managed Service for Prometheus"
  url  = "https://aps-workspaces.${var.region}.amazonaws.com/workspaces/${var.workspace_id}"

  json_data_encoded = jsonencode({
    httpMethod    = "POST"
    sigV4Auth     = true
    sigV4AuthType = "keys"
    sigV4Region   = var.region
    sigv4Service  = "aps"
    defaultEditor = "builder"
    manageAlerts  = true
  })

  secure_json_data_encoded = jsonencode({
    sigV4AccessKey = var.access_key_id
    sigV4SecretKey = var.secret_access_key
  })
}

To use an assume-role configuration instead of static keys, set sigV4AuthType to default or ec2_iam_role and provide the role details:

hcl Copy

resource "grafana_data_source" "amazonprometheus" {
  type = "grafana-amazonprometheus-datasource"
  name = "Amazon Managed Service for Prometheus"
  url  = "https://aps-workspaces.${var.region}.amazonaws.com/workspaces/${var.workspace_id}"

  json_data_encoded = jsonencode({
    sigV4Auth     = true
    sigV4AuthType = "default"
    sigV4Region   = var.region
    sigv4Service  = "aps"
    assumeRoleArn = var.assume_role_arn
    externalId    = var.external_id
  })
}

Define the referenced variables, for example in a variables.tf file:

hcl Copy

variable "region" {
  type = string
}

variable "workspace_id" {
  type = string
}

variable "access_key_id" {
  type      = string
  sensitive = true
}

variable "secret_access_key" {
  type      = string
  sensitive = true
}