AWS CloudWatch on Grafana Labs

Authentication

Sat, 04 Apr 2026 12:26:57 +0000

AWS authentication

Requests from a Grafana plugin to AWS are made on behalf of an IAM role or an IAM user. The IAM user or IAM role must have the associated policies to perform certain API actions. Since these policies are specific to each data source, refer to the data source documentation for details.

All requests to AWS APIs are performed on the server side by the Grafana backend using the official AWS SDK.

This topic has the following sections:

Authentication methods

You can use one of the following authentication methods. Currently, AWS SDK Default, Credentials file and Access and secret key are enabled by default in open source Grafana. You can enable/disable them if necessary if you have server configuration access. For more information, refer to allowed_auth_providers documentation.

AWS SDK Default performs no custom configuration and instead uses the default provider as specified by the AWS SDK for Go. It requires you to configure your AWS credentials separately, such as if you’ve configured the CLI, if you’re running on an EC2 instance, in an ECS task, or for a Service Account in a Kubernetes cluster.
Credentials file corresponds directly to the SharedCredentialsProvider provider in the Go SDK. It reads the AWS shared credentials file to find a given profile. While AWS SDK Default will also find the shared credentials file, this option allows you to specify which profile to use without using environment variables. This option doesn’t have any implicit fallbacks to other credential providers, and it fails if the credentials provided from the file aren’t correct.
Access and secret key corresponds to the StaticProvider and uses the given access key ID and secret key to authenticate. This method doesn’t have any fallbacks, and will fail if the provided key pair doesn’t work.
Workspace IAM role corresponds to the EC2RoleProvider. The EC2RoleProvider pulls credentials for a role attached to the EC2 instance that Grafana runs on. You can also achieve this by using the authentication method AWS SDK Default, but this option is different as it doesn’t have any fallbacks. This option is currently only enabled by default in Amazon Managed Grafana.

Assuming a role

The Assume Role ARN field allows you to specify which IAM role to assume. When left blank, the provided credentials are used directly and the associated role or user should have the required permissions. If this field is non-blank, on the other hand, the provided credentials are used to perform an sts:AssumeRole call.

You can disable this feature in the Grafana configuration. For more information, refer to assume_role_enabled documentation.

External ID

If you are assuming a role in another account that was created with an external ID, then specify the external ID in this field. For more information, refer to the AWS documentation on external ID.

Endpoint

The Endpoint field allows you to specify a custom endpoint URL that overrides the default generated endpoint for the AWS service API. Leave this field blank if you want to use the default generated endpoint. For more information on why and how to use Service endpoints, refer to the AWS service endpoints documentation.

AWS credentials file

Create a file at ~/.aws/credentials. That is the HOME path for user running grafana-server.

Note: If you think you have the credentials file in the right place and it is still not working, you might try moving your .aws file to ‘/usr/share/grafana/’ and make sure your credentials file has at most 0644 permissions.

Example content:

[default]
aws_access_key_id = asdsadasdasdasd
aws_secret_access_key = dasdasdsadasdasdasdsa
region = us-west-2

EKS IAM roles for service accounts

The Grafana process in the container runs as user 472 (called “grafana”). When Kubernetes mounts your projected credentials, they will by default only be available to the root user. To allow user 472 to access the credentials (and avoid falling back to the IAM role attached to the EC2 instance), you need to provide a security context for your pod.

securityContext:
  fsGroup: 472
  runAsUser: 472
  runAsGroup: 472

Template variables in CloudWatch query

Sat, 04 Apr 2026 12:26:57 +0000

Using template variables in CloudWatch queries

Instead of hard-coding server, application, and sensor names in your metric queries, you can use variables. The variables are listed as dropdown select boxes at the top of the dashboard. These dropdowns make it easy to change the display of data in your dashboard.

For an introduction to templating and template variables, refer to the Templating documentation.

Query variable

The CloudWatch data source provides the following queries that you can specify in the Query field in the Variable edit view. They allow you to fill a variable’s options list with things like region, namespaces, metric names and dimension keys/values.

In place of region you can specify default to use the default region configured in the data source for the query, e.g. metrics(AWS/DynamoDB, default) or dimension_values(default, ..., ..., ...).

Read more about the available dimensions in the CloudWatch Metrics and Dimensions Reference.

Name	Description
`regions()`	Returns a list of all AWS regions
`namespaces()`	Returns a list of namespaces CloudWatch support.
`metrics(namespace, [region])`	Returns a list of metrics in the namespace. (specify region or use “default” for custom metrics)
`dimension_keys(namespace)`	Returns a list of dimension keys in the namespace.
`dimension_values(region, namespace, metric, dimension_key, [filters])`	Returns a list of dimension values matching the specified `region`, `namespace`, `metric`, `dimension_key` or you can use dimension `filters` to get more specific result as well.
`ebs_volume_ids(region, instance_id)`	Returns a list of volume ids matching the specified `region`, `instance_id`.
`ec2_instance_attribute(region, attribute_name, filters)`	Returns a list of attributes matching the specified `region`, `attribute_name`, `filters`.
`resource_arns(region, resource_type, tags)`	Returns a list of ARNs matching the specified `region`, `resource_type` and `tags`.
`statistics()`	Returns a list of all the standard statistics

For details about the metrics CloudWatch provides, please refer to the CloudWatch documentation.

Example of templated queries

Here is an example of the dimension queries which will return list of resources for individual AWS Services:

Query	Service
`dimension_values(us-east-1,AWS/ELB,RequestCount,LoadBalancerName)`	ELB
`dimension_values(us-east-1,AWS/ElastiCache,CPUUtilization,CacheClusterId)`	ElastiCache
`dimension_values(us-east-1,AWS/Redshift,CPUUtilization,ClusterIdentifier)`	RedShift
`dimension_values(us-east-1,AWS/RDS,CPUUtilization,DBInstanceIdentifier)`	RDS
`dimension_values(us-east-1,AWS/S3,BucketSizeBytes,BucketName)`	S3
`dimension_values(us-east-1,CWAgent,disk_used_percent,device,{"InstanceId":"$instance_id"})`	CloudWatch Agent
`resource_arns(eu-west-1,elasticloadbalancing:loadbalancer,{"elasticbeanstalk:environment-name":["myApp-dev","myApp-prod"]})`	ELB
`resource_arns(eu-west-1,elasticloadbalancing:loadbalancer,{"Component":["$service"],"Environment":["$environment"]})`	ELB
`resource_arns(eu-west-1,ec2:instance,{"elasticbeanstalk:environment-name":["myApp-dev","myApp-prod"]})`	EC2

Using JSON format template variables

Some queries accept filters in JSON format and Grafana supports the conversion of template variables to JSON.

If env = 'production', 'staging', following query will return ARNs of EC2 instances which Environment tag is production or staging.

resource_arns(us-east-1, ec2:instance, {"Environment":${env:json}})

ec2_instance_attribute examples

JSON filters

The ec2_instance_attribute query takes filters in JSON format. You can specify pre-defined filters of ec2:DescribeInstances. Note that the actual filtering takes place on Amazon’s servers, not in Grafana.

Filters syntax:

{ "filter_name1": [ "filter_value1" ], "filter_name2": [ "filter_value2" ] }

Example ec2_instance_attribute() query

ec2_instance_attribute(us - east - 1, InstanceId, { 'tag:Environment': ['production'] });

Selecting attributes

Only 1 attribute per instance can be returned. Any flat attribute can be selected (i.e. if the attribute has a single value and isn’t an object or array). Below is a list of available flat attributes:

AmiLaunchIndex
Architecture
ClientToken
EbsOptimized
EnaSupport
Hypervisor
IamInstanceProfile
ImageId
InstanceId
InstanceLifecycle
InstanceType
KernelId
KeyName
LaunchTime
Platform
PrivateDnsName
PrivateIpAddress
PublicDnsName
PublicIpAddress
RamdiskId
RootDeviceName
RootDeviceType
SourceDestCheck
SpotInstanceRequestId
SriovNetSupport
SubnetId
VirtualizationType
VpcId

Tags can be selected by prepending the tag name with Tags.

Example ec2_instance_attribute() query

ec2_instance_attribute(us - east - 1, Tags.Name, { 'tag:Team': ['sysops'] });

Curated CloudWatch dashboards

Sat, 04 Apr 2026 12:26:57 +0000

Curated CloudWatch dashboards

The updated CloudWatch data source ships with pre-configured dashboards for five of the most popular AWS services:

Amazon Elastic Compute Cloud Amazon EC2,
Amazon Elastic Block Store Amazon EBS,
AWS Lambda AWS Lambda,
Amazon CloudWatch Logs Amazon CloudWatch Logs, and
Amazon Relational Database Service Amazon RDS.

To import curatedd dashboards:

On the configuration page of your CloudWatch data source, click the Dashboards tab.
Click Import for the dashboard you would like to use.

In case you want to customize a dashboard, we recommend that you save it under a different name. Otherwise the dashboard will be overwritten when a new version of the dashboard is released.

Provision CloudWatch

Sat, 04 Apr 2026 12:26:57 +0000

Provision CloudWatch data source

You can configure the CloudWatch data source by customizing configuration files in Grafana’s provisioning system. To know more about provisioning and learn about available configuration options, refer to the Provisioning Grafana topic.

Here are some provisioning examples for this data source.

Using AWS SDK (default)

apiVersion: 1
datasources:
  - name: CloudWatch
    type: cloudwatch
    jsonData:
      authType: default
      defaultRegion: eu-west-2

Using credentials’ profile name (non-default)

apiVersion: 1

datasources:
  - name: CloudWatch
    type: cloudwatch
    jsonData:
      authType: credentials
      defaultRegion: eu-west-2
      customMetricsNamespaces: 'CWAgent,CustomNameSpace'
      profile: secondary

Using accessKey and secretKey

apiVersion: 1

datasources:
  - name: CloudWatch
    type: cloudwatch
    jsonData:
      authType: keys
      defaultRegion: eu-west-2
    secureJsonData:
      accessKey: '<your access key>'
      secretKey: '<your secret key>'

Using AWS SDK Default and ARN of IAM Role to Assume

apiVersion: 1
datasources:
  - name: CloudWatch
    type: cloudwatch
    jsonData:
      authType: default
      assumeRoleArn: arn:aws:iam::123456789012:root
      defaultRegion: eu-west-2