Documentation Plugins DynamoDB Configure

Configure the DynamoDB data source

This document explains how to configure the DynamoDB data source in Grafana. DynamoDB uses the AWS SDK for Go to connect to your DynamoDB instance using AWS IAM credentials.

Before you begin

Before configuring the data source, ensure you have:

• Grafana permissions: Organization administrator role.
• A Grafana Cloud Pro or Advanced plan or an activated on-prem Grafana Enterprise license.
• AWS credentials: An IAM user with an access key and secret key, or a shared credentials file configured on the Grafana server.
• DynamoDB permissions: The IAM identity must have dynamodb:PartiQLSelect permission on the tables you want to query. For write operations, additional PartiQL permissions may be needed.

Key concepts

If you’re new to AWS, these terms are used throughout the configuration:

Add the data source

To add the data source:

1. Click Connections in the left-side menu.
2. Click Add new connection.
3. Type DynamoDB in the search bar.
4. Select DynamoDB.
5. Click Add new data source.

Configure settings

The following table describes the available connection settings:

Authentication

The DynamoDB data source supports two authentication methods. Choose the method that fits your deployment.

Access keys

Use static IAM access keys to authenticate directly with AWS. This is the default authentication method.

To configure access key authentication:

1. Select Access & secret key from the Authentication Provider drop-down.
2. Enter your Access Key ID.
3. Enter your Secret Access Key.
4. Optionally, enter a Session Token if using temporary credentials.
5. Select your Default Region.

AWS credentials file

Use a shared credentials file stored on the Grafana server to authenticate. This method reads credentials from ~/.aws/credentials.

To configure credentials file authentication:

1. Select Credentials file from the Authentication Provider drop-down.
2. Enter the Credentials Profile Name if you use a non-default profile.
3. Select your Default Region.

Verify the connection

Click Save & test to verify the connection. A Data source is working message confirms that Grafana can connect to your DynamoDB instance.

If the test fails, refer to Troubleshoot DynamoDB data source issues for common errors and solutions.

Provision the data source

You can define the data source in YAML files as part of the Grafana provisioning system. For more information, refer to Provisioning Grafana data sources.

Advanced settings

The following optional settings are available through provisioning only and don’t appear in the UI:

Include these in jsonData to override the defaults.

Access key provisioning

YAML Copy

apiVersion: 1

datasources:
  - name: DynamoDB
    type: grafana-dynamodb-datasource
    jsonData:
      authType: keys
      defaultRegion: us-west-2
      isV2: true
    secureJsonData:
      accessKey: <ACCESS_KEY_ID>
      secretKey: <SECRET_ACCESS_KEY>

To include a session token for temporary credentials, add sessionToken to secureJsonData:

YAML Copy

apiVersion: 1

datasources:
  - name: DynamoDB
    type: grafana-dynamodb-datasource
    jsonData:
      authType: keys
      defaultRegion: us-west-2
      isV2: true
    secureJsonData:
      accessKey: <ACCESS_KEY_ID>
      secretKey: <SECRET_ACCESS_KEY>
      sessionToken: <SESSION_TOKEN>

Credentials file provisioning

YAML Copy

apiVersion: 1

datasources:
  - name: DynamoDB
    type: grafana-dynamodb-datasource
    jsonData:
      authType: credentials
      defaultRegion: us-west-2
      profile: <PROFILE_NAME>
      isV2: true

Provision with Terraform

You can provision the DynamoDB data source using the Grafana Terraform provider.

hcl Copy

resource "grafana_data_source" "dynamodb" {
  type = "grafana-dynamodb-datasource"
  name = "DynamoDB"

  json_data_encoded = jsonencode({
    authType      = "keys"
    defaultRegion = "us-west-2"
    isV2          = true
  })

  secure_json_data_encoded = jsonencode({
    accessKey = var.aws_access_key_id
    secretKey = var.aws_secret_access_key
  })
}

For credentials file authentication:

hcl Copy

resource "grafana_data_source" "dynamodb" {
  type = "grafana-dynamodb-datasource"
  name = "DynamoDB"

  json_data_encoded = jsonencode({
    authType      = "credentials"
    defaultRegion = "us-west-2"
    profile       = "my-profile"
    isV2          = true
  })
}