Grafana on AWS, step by step

Grafana is an open-source solu­tion for ana­lyt­ics and mon­it­or­ing, that sup­ports mul­tiple tools as data sources. This gives us the advant­age to have dash­boards that not only have Cloud­Watch met­rics on it, but also met­rics from other tools like Pro­meth­eus, Red­shift, and much more.

Hav­ing said that, Grafana needs to be liv­ing some­where: inside a server like an EC2 instance or deployed as a pod in Kuber­netes. But these options come with the draw­back that they need to be installed, con­figured, and main­tained. If we want to quickly start cre­at­ing our mon­it­or­ing sys­tem, that will take us some time and effort.

This is where Amazon Man­aged Grafana comes in handy, which is a fully man­aged ser­vice for Grafana that can be integ­rated with AWS IAM Iden­tity Cen­ter (suc­cessor to AWS SSO), in order to also provide the layer of authen­tic­a­tion and author­iz­a­tion using our exist­ing cre­den­tials for our AWS account.

In this blog­ar­ticle I’m going to explain how to deploy Amazon Man­aged Grafana, assum­ing an account with AWS IAM Iden­tity Cen­ter is already enabled.

Cre­at­ing a Grafana work­space in AWS

To begin, we login in our account from our AWS IAM Iden­tity Cen­ter page, which would be look­ing some­thing like:

Then search for Grafana and click on “Cre­ate workspace”.

Write the name of the work­space, and option­ally a descrip­tion and tags (which can be used for billing pur­poses for example).

Next step is to click on “AWS IAM Iden­tity Cen­ter” and we leave the rest with the default val­ues for this example.

Then choose Amazon Cloud­Watch as data source in order for AWS to cre­ate a role with the neces­sary per­mis­sion to query it. Here we could choose other AWS sources as data sources, depend­ing on our use case. And besides that, we will also enable AWS SNS as a noti­fic­a­tion channel.

Review the details and click on “Cre­ate workspace”.

Wait until the work­space is cre­ated and the res­ult should be some­thing like this:

Notice that AWS will auto­mat­ic­ally cre­ate an URL which we can use to access Grafana. It is also pos­sible to see the role that has all the neces­sary per­mis­sions to access the data sources that we pre­vi­ously chose. Keep in mind that the URL will be deleted once we also delete our workspace.

User man­age­ment

Amazon Man­aged Grafana sup­ports 3 types of user roles: Admin, Editor and Viewer. For more inform­a­tion about the dif­fer­ences, click the link to the offi­cial doc­u­ment­a­tion.

For this example, I will add my user as admin­is­trator of the work­space and a group as viewer. In order to do so, we will click on “Assign new user or group” as shown in the pre­vi­ous image.

Then on “Users” we will search for the user and on “Groups” for the group. After that we click on “Assign users and groups”. The Viewer type will be given by default.

Now select the user, click on “Action” and then “Make admin”.

Fol­low­ing we will have our Admin user and Viewer group like this:

Any­one who is part of that group, and the admin user can then access Grafana from the URL we pre­vi­ously saw, or by open­ing again our AWS IAM Iden­tity Cen­ter page, which will look like this:

With the admin user, we can go to “Con­fig­ur­a­tion -> Users” to see all the users already using our workspace.

This com­pletes the first con­fig­ur­a­tion of user and groups. One thing to remem­ber is, that the roles con­figured for the users and groups will be applied for the entire work­space, which means that by default, any user of the above group can view any dash­board inside the workspace.

If we have mul­tiple groups which should have dif­fer­ent roles, of course we can cre­ate mul­tiple work­spaces for each of them, but this wouldn’t be cost effect­ive most of times. For the sake of shar­ing one single work­space, hav­ing mul­tiple teams, and assign­ing dif­fer­ent per­mis­sion to them inside Grafana, we need to do the fol­low­ing: Go to “Con­fig­ur­a­tion -> Teams -> New team”.

Name the team, also men­tion­ing which role the team has.

Even though my user is Admin already, for this example I will still add it as a team mem­ber. There­fore, click on the team we just cre­ated, look for the user and then click on “Add to team”.

After that, we can cre­ate all the neces­sary teams, also adding their mem­bers as soon as they log in (they will not appear until then). For example, we can have some­thing like this:

Folder struc­ture

Now we need to cre­ate this struc­ture, so each team can use the work­space without affect­ing each other by mis­take.
Go to “Dash­boards -> Browse”.

Click on “New Folder”.

Name the dash­board and click on “Cre­ate”.

Next go to “Per­mis­sions”.

Delete Editor and Viewer per­mis­sions that are there by default, click­ing the red “X button”.

Now select “Add Per­mis­sion”, choose the team that should have access to that folder with the neces­sary per­mis­sion. After adding all neces­sary teams, it will look like this:

Repeat all the steps from the cre­ation of the folder for all the other teams and then we will finally have a work­space that can be shared among dif­fer­ent teams.

Where are my metrics?

With this approach, we can also have shared data sources or also restrict the access of the data sources by team. In this example we will add CloudWatch.

Go to “Con­fig­ur­a­tion -> Data Sources” -> Click on “Add data source”.

Search for “Cloud­Watch” and click on it. Leave all fields with the default val­ues they cur­rently have and click on “Save & test”.

After that, Cloud­Watch will be avail­able for all the teams. If you would want to restrict the access, we would go to “Per­mis­sions” and add only the teams that can use it.

You have done it!

Now our teams can finally start cre­at­ing their dash­boards and our struc­ture would look like the following:

Next steps

We have deployed a work­space with mostly choos­ing all default con­fig­ur­a­tion val­ues. Amazon Man­aged Grafana still provides so much more fea­tures that we can use to pro­tect our work­space, the data sources it can access, noti­fic­a­tions that can be sent based on a met­ric, among oth­ers.
I hope this inform­a­tion is use­ful and that this base can help your teams to quickly have a tool to mon­itor their AWS Ser­vices, infra­struc­ture, and applications.