To manually add the CloudWatch data source
-
In the Grafana console side menu, hover over the Configuration (gear) icon, and then choose Data Sources.
-
Choose Add data source.
-
Choose the CloudWatch data source. If necessary, you can start typing
CloudWatchin the search box to help you find it.
CloudWatch settings
The following CloudWatch settings apply.
Name |
Description |
|---|---|
|
|
The data source name. This is how you see the data source in panels and queries. |
|
|
Designates the data source to be pre-selected for new panels. |
|
|
Set the Region in the query editor. Can be changed on per-query basis. |
|
|
Specifies the CloudWatch namespaces of custom metrics. Can include multiple namespaces, separated by commas. |
|
|
Specifies the provider to get credentials. |
|
|
Specifies the Amazon Resource Name (ARN) of the role to assume. |
|
|
(Optional) Specifies the external ID. Use if you are assuming a role in another AWS account that has been created with an external ID. |
|
Configure the timeout specifically for CloudWatch Logs queries. |
|
To automatically add links in your logs when the
log contains the |
Authentication
To enable authentication between Amazon Managed Grafana and CloudWatch, you can use the Amazon Managed Grafana console to quickly create the policies and permissions that are needed. Alternatively, you can manually set up authentication using some of the same methods that you would on a self-managed Grafana server.
To use Amazon Managed Grafana data source configuration to quickly set up the policies, follow the steps in Use AWS data source configuration to add CloudWatch as a data source.
To set up the permissions manually, use one of the methods in the following section.
AWS credentials
There are three different authentication methods available.
-
AWS SDK Default— Uses the permissions defined in the role that is attached to your workspace. For more information, see Customer-managed permissions.
-
Access and secret key— Corresponds to the AWS SDK for Go
StaticProvider. Uses the given access key ID and secret key to authenticate. This method doesn’t have any fallbacks, and will fail if the provided key pair doesn’t work.
IAM roles
Currently, all access to CloudWatch is done server-side by the Grafana backend using the official AWS SDK. If you choose the AWS SDK Default authentication method, and your Grafana server is running on AWS, you can use IAM roles to handle authentication automatically.
For more information, see IAM roles.
IAM policies
Grafana needs permissions granted through IAM to be able to read CloudWatch metrics and EC2 tags, instances, and Regions. You can attach these permissions to IAM roles and use the built-in Grafana support for assuming roles.
The following code example shows a minimal policy.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowReadingMetricsFromCloudWatch",
"Effect": "Allow",
"Action": [
"cloudwatch:DescribeAlarmsForMetric",
"cloudwatch:DescribeAlarmHistory",
"cloudwatch:DescribeAlarms",
"cloudwatch:ListMetrics",
"cloudwatch:GetMetricStatistics",
"cloudwatch:GetMetricData",
"cloudwatch:GetInsightRuleReport"
],
"Resource": "*"
},
{
"Sid": "AllowReadingLogsFromCloudWatch",
"Effect": "Allow",
"Action": [
"logs:DescribeLogGroups",
"logs:GetLogGroupFields",
"logs:StartQuery",
"logs:StopQuery",
"logs:GetQueryResults",
"logs:GetLogEvents"
],
"Resource": "*"
},
{
"Sid": "AllowReadingTagsInstancesRegionsFromEC2",
"Effect": "Allow",
"Action": ["ec2:DescribeTags", "ec2:DescribeInstances", "ec2:DescribeRegions"],
"Resource": "*"
},
{
"Sid": "AllowReadingResourcesForTags",
"Effect": "Allow",
"Action": "tag:GetResources",
"Resource": "*"
},
{
"Sid": "AllowReadingAcrossAccounts",
"Effect": "Allow",
"Action": [
"oam:ListSinks",
"oam:ListAttachedLinks"
],
"Resource": "*"
}
]
}
Assuming a role
The Assume Role ARN field allows you to specify
which IAM role to assume, if any. If you keep this blank, the
provided credentials are used directly and the associated role or
user should have the required permissions. If this field is not
blank, the provided credentials are used to perform an
sts:AssumeRole call.
