root
/
grafana
mirror of https://github.com/grafana/grafana.git
1
0
Fork 0
Code Issues Actions 142 Packages Projects Releases Wiki Activity

[release-12.1.1] AWS Datasources: Update grafana assume role docs for GA (#109403) 

AWS Datasources: Update grafana assume role docs for GA (#107220)



(cherry picked from commit da0f1d7b18)

Co-authored-by: Isabella Siu <Isabella.siu@grafana.com>
Co-authored-by: Larissa Wandzura <126723338+lwandz13@users.noreply.github.com>
Co-authored-by: Kevin Yu <kevinwcyu@users.noreply.github.com>
This commit is contained in:
grafana-delivery-bot[bot] 2025-08-08 15:14:27 +01:00 committed by GitHub
parent 1c3628f3c6
commit 5130b3c704
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
6 changed files with 27 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
docs/sources/datasources/aws-cloudwatch/aws-authentication/index.md
View File

@ -160,26 +160,22 @@ securityContext:
## Use Grafana Assume Role ## Use Grafana Assume Role
{{< admonition type="note" >}} {{< admonition type="note" >}}
Grafana Assume Role is currently in [private preview](https://grafana.com/docs/release-life-cycle/) for Grafana Cloud. Grafana Assume Role is only available in Grafana Cloud.
It's currently only available for Amazon CloudWatch. It's currently only available for Amazon CloudWatch and Athena.
To gain early access to this feature, contact Customer Support and ask for the `awsDatasourcesTempCredentials` feature toggle to be enabled on your account.
{{< /admonition >}} {{< /admonition >}}
The Grafana Assume Role authentication provider lets you authenticate with AWS without having to create and maintain long term AWS users or rotate their access and secret keys. Instead, you can create an IAM role that has permissions to access CloudWatch and a trust relationship with Grafana's AWS account. Grafana's AWS account then makes an STS request to AWS to create temporary credentials to access your AWS data. It makes this STS request by passing along an `externalID` that's unique per Cloud account, to ensure that Grafana Cloud users can only access their own AWS data. For more information, refer to the [AWS documentation on external ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html). The Grafana Assume Role authentication provider lets you authenticate with AWS without having to create and maintain long term AWS users or rotate their access and secret keys. Instead, you can create an IAM role that has permissions to access CloudWatch and a trust relationship with Grafana's AWS account. Grafana's AWS account then makes an STS request to AWS to create temporary credentials to access your AWS data. It makes this STS request by passing along an `externalID` that's unique per Cloud account, to ensure that Grafana Cloud users can only access their own AWS data. For more information, refer to the [AWS documentation on external ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html).
To use the Grafana Assume Role: To use the Grafana Assume Role:
1. Grafana Cloud customers need to open a support ticket to enable the feature `awsDatasourcesTempCredentials`. 1. Create a new CloudWatch data source (or update an existing one) and select **Grafana Assume Role** as an authentication provider.
This feature is enabled by default in open source Grafana and Grafana Enterprise. 2. In the AWS Console, create a new IAM role, and under **Trusted entity type**, select **Another AWS account** as the trusted Entity.
2. Once the feature is enabled, create a new CloudWatch data source (or update an existing one) and select **Grafana Assume Role** as an authentication provider. 3. Enter the Grafana account id (displayed in the instructions box on the **Settings** tab of the CloudWatch data source configuration) and check the **Require external ID** box.
3. In the AWS Console, create a new IAM role, and under **Trusted entity type**, select **Another AWS account** as the trusted Entity. 4. Enter the external ID specified in the instructions box on the **Settings** tab of the CloudWatch data source configuration in Grafana. This external ID will be unique to your Grafana instance.
4. Enter Grafana's account id (displayed in the instructions box on the **Settings** tab of the CloudWatch data source configuration) and check the **Require external ID** box. 5. Attach any required permissions you would like Grafana to be able to access on your behalf (for example, CloudWatch Logs and CloudWatch Metrics policies).
5. Enter the external ID specified in the instructions box on the **Settings** tab of the CloudWatch data source configuration in Grafana. This external ID will be unique to your Grafana instance. 6. Give the role a name and description, and click **Create role**.
6. Attach any required permissions you would like Grafana to be able to access on your behalf (for example, CloudWatch Logs and CloudWatch Metrics policies). 7. Copy the ARN of the role you just created and paste it into the **Assume Role ARN** field on the **Settings** tab of CloudWatch data source configuration in Grafana.
7. Give the role a name and description, and click **Create role**.
8. Copy the ARN of the role you just created and paste it into the **Assume Role ARN** field on the **Settings** tab of CloudWatch data source configuration in Grafana.
Sample Trust Relationship for an IAM role: Sample Trust Relationship for an IAM role:

1
docs/sources/setup-grafana/configure-grafana/feature-toggles/index.md
View File

@ -38,6 +38,7 @@ Most [generally available](https://grafana.com/docs/release-life-cycle/#general-
| `pluginsDetailsRightPanel` | Enables right panel for the plugins details page | Yes | | `pluginsDetailsRightPanel` | Enables right panel for the plugins details page | Yes |
| `recordedQueriesMulti` | Enables writing multiple items from a single query within Recorded Queries | Yes | | `recordedQueriesMulti` | Enables writing multiple items from a single query within Recorded Queries | Yes |
| `logsExploreTableVisualisation` | A table visualisation for logs in Explore | Yes | | `logsExploreTableVisualisation` | A table visualisation for logs in Explore | Yes |
| `awsDatasourcesTempCredentials` | Support temporary security credentials in AWS plugins for Grafana Cloud customers | Yes |
| `transformationsRedesign` | Enables the transformations redesign | Yes | | `transformationsRedesign` | Enables the transformations redesign | Yes |
| `awsAsyncQueryCaching` | Enable caching for async queries for Redshift and Athena. Requires that the datasource has caching and async query support enabled | Yes | | `awsAsyncQueryCaching` | Enable caching for async queries for Redshift and Athena. Requires that the datasource has caching and async query support enabled | Yes |
| `dashgpt` | Enable AI powered features in dashboards | Yes | | `dashgpt` | Enable AI powered features in dashboards | Yes |

1
packages/grafana-data/src/types/featureToggles.gen.ts
View File

@ -186,6 +186,7 @@ export interface FeatureToggles {
logsExploreTableVisualisation?: boolean; logsExploreTableVisualisation?: boolean;
/** /**
* Support temporary security credentials in AWS plugins for Grafana Cloud customers * Support temporary security credentials in AWS plugins for Grafana Cloud customers
* @default true
*/ */
awsDatasourcesTempCredentials?: boolean; awsDatasourcesTempCredentials?: boolean;
/** /**

3
pkg/services/featuremgmt/registry.go
View File

@ -296,7 +296,8 @@ var (
{ {
Name: "awsDatasourcesTempCredentials", Name: "awsDatasourcesTempCredentials",
Description: "Support temporary security credentials in AWS plugins for Grafana Cloud customers", Description: "Support temporary security credentials in AWS plugins for Grafana Cloud customers",
Stage: FeatureStageExperimental, Stage: FeatureStageGeneralAvailability,
Expression: "true", // enabled by default
Owner: awsDatasourcesSquad, Owner: awsDatasourcesSquad,
}, },
{ {

2
pkg/services/featuremgmt/toggles_gen.csv
View File

@ -37,7 +37,7 @@ pluginsDetailsRightPanel,GA,@grafana/plugins-platform-backend,false,false,true
sqlDatasourceDatabaseSelection,preview,@grafana/oss-big-tent,false,false,true sqlDatasourceDatabaseSelection,preview,@grafana/oss-big-tent,false,false,true
recordedQueriesMulti,GA,@grafana/observability-metrics,false,false,false recordedQueriesMulti,GA,@grafana/observability-metrics,false,false,false
logsExploreTableVisualisation,GA,@grafana/observability-logs,false,false,true logsExploreTableVisualisation,GA,@grafana/observability-logs,false,false,true
awsDatasourcesTempCredentials,experimental,@grafana/aws-datasources,false,false,false awsDatasourcesTempCredentials,GA,@grafana/aws-datasources,false,false,false
transformationsRedesign,GA,@grafana/observability-metrics,false,false,true transformationsRedesign,GA,@grafana/observability-metrics,false,false,true
mlExpressions,experimental,@grafana/alerting-squad,false,false,false mlExpressions,experimental,@grafana/alerting-squad,false,false,false
datasourceAPIServers,experimental,@grafana/grafana-app-platform-squad,false,true,false datasourceAPIServers,experimental,@grafana/grafana-app-platform-squad,false,true,false

1 Name Stage Owner requiresDevMode RequiresRestart FrontendOnly
37 sqlDatasourceDatabaseSelection preview @grafana/oss-big-tent false false true
38 recordedQueriesMulti GA @grafana/observability-metrics false false false
39 logsExploreTableVisualisation GA @grafana/observability-logs false false true
40 awsDatasourcesTempCredentials experimental GA @grafana/aws-datasources false false false
41 transformationsRedesign GA @grafana/observability-metrics false false true
42 mlExpressions experimental @grafana/alerting-squad false false false
43 datasourceAPIServers experimental @grafana/grafana-app-platform-squad false true false

19
pkg/services/featuremgmt/toggles_gen.json
View File

@ -472,13 +472,17 @@
{ {
"metadata": { "metadata": {
"name": "awsDatasourcesTempCredentials", "name": "awsDatasourcesTempCredentials",
"resourceVersion": "1750434297879", "resourceVersion": "1752523189825",
"creationTimestamp": "2023-07-06T15:06:11Z" "creationTimestamp": "2023-07-06T15:06:11Z",
"annotations": {
"grafana.app/updatedTimestamp": "2025-07-14 19:59:49.825959 +0000 UTC"
}
}, },
"spec": { "spec": {
"description": "Support temporary security credentials in AWS plugins for Grafana Cloud customers", "description": "Support temporary security credentials in AWS plugins for Grafana Cloud customers",
"stage": "experimental", "stage": "GA",
"codeowner": "@grafana/aws-datasources" "codeowner": "@grafana/aws-datasources",
"expression": "true"
} }
}, },
{ {
@ -2022,8 +2026,11 @@
{ {
"metadata": { "metadata": {
"name": "multiTenantTempCredentials", "name": "multiTenantTempCredentials",
"resourceVersion": "1750434297879", "resourceVersion": "1752523189825",
"creationTimestamp": "2025-04-02T20:25:50Z" "creationTimestamp": "2025-04-02T20:25:50Z",
"annotations": {
"grafana.app/updatedTimestamp": "2025-07-14 19:59:49.825959 +0000 UTC"
}
}, },
"spec": { "spec": {
"description": "use multi-tenant path for awsTempCredentials", "description": "use multi-tenant path for awsTempCredentials",