AWS Managed Grafana

​

What the AWS Managed Grafana integration enables

​

How it works

• Amazon CloudWatch — metrics and logs from AWS services and your applications
• AWS X-Ray — distributed tracing
• Amazon Managed Prometheus (AMP) — PromQL-compatible metrics storage for custom application metrics

​

Prerequisites

• An AWS account
• An Amazon Managed Grafana workspace (or you’ll create one during setup)
• An IAM user or role with grafana:* permissions on the workspace
• Optionally: an Amazon Managed Prometheus workspace for application metrics

​

Step 1: Create a Managed Grafana workspace

1. Open the Amazon Managed Grafana console.
2. Click Create workspace.
3. Enter a name (e.g., obsy-workspace) and click Next.
4. For authentication, select AWS IAM Identity Center (SSO) or SAML — either works.
5. Under Data sources, enable:
   • Amazon CloudWatch — for AWS infrastructure metrics
   • AWS X-Ray — for distributed tracing
   • Amazon Managed Service for Prometheus (optional) — for custom app metrics
6. Review and click Create workspace.
7. Wait for the workspace status to become Active.
8. Copy the Workspace ID — it starts with g- (e.g., g-abc123def4).

​

Step 2: Create an IAM user for Obsy

1. Go to IAM Console → Users.
2. Click Create user, name it obsy-grafana-access.
3. Select Attach policies directly.
4. Click Create policy and paste this JSON:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ObsyGrafanaAccess",
      "Effect": "Allow",
      "Action": "grafana:*",
      "Resource": "arn:aws:grafana:*:*:/workspaces/*"
    }
  ]
}

5. Name the policy ObsyGrafanaAccess and attach it to the user.
6. After creating the user, go to the Security credentials tab.
7. Click Create access key → select Third-party service as the use case.
8. Copy both the Access Key ID and Secret Access Key.

​

Step 3: Connect in Obsy

1. In Obsy, go to Integrations and click Add Platform.
2. Select AWS Managed Grafana.
3. Fill in:
   • Region — the AWS region where your workspace lives (e.g., us-east-1)
   • Workspace ID — starts with g- (from step 1)
   • Access Key ID — from step 2
   • Secret Access Key — from step 2
4. Optionally fill in:
   • IAM Role ARN — if your workspace is in a different account (see cross-account section below)
   • AMP Workspace ID — if you have Amazon Managed Prometheus set up (starts with ws-)
5. Click Test Connection to verify.
6. Click Continue or Save.

​

Step 4 (Optional): Set up Amazon Managed Prometheus

1. Open the Amazon Managed Prometheus console.
2. Click Create workspace, give it a name (e.g., obsy-metrics).
3. Copy the Workspace ID (starts with ws-).
4. In your AMG workspace, AMP should appear automatically as a data source if you enabled it during workspace creation. If not, add it manually under Configuration → Data sources → Add data source → Prometheus with the AMP workspace endpoint URL.

​

Cross-account access

1. In the target account (where the workspace lives), create an IAM role:
   • Name: ObsyGrafanaCrossAccountRole
   • Trust policy: allow the source account to assume this role
   • Permissions: attach the ObsyGrafanaAccess policy from step 2
2. In Obsy, enter the role ARN in the IAM Role ARN field (e.g., arn:aws:iam::123456789012:role/ObsyGrafanaCrossAccountRole).
3. Optionally set an External ID for additional security.

​

OTel collector export configuration

​

Updating or removing the connection

1. Go to Integrations → find the AWS Managed Grafana card.
2. Use Edit to update credentials or workspace configuration.
3. Use Disconnect to remove the connection.

​

Troubleshooting

​

”Authentication failed” error

• Verify the IAM user has the grafana:* policy attached.
• Check the access key is active (not disabled) in IAM Console → Security credentials.
• Ensure the region matches where the workspace is deployed.

​

”Workspace not found” error

• Double-check the workspace ID starts with g-.
• Ensure the workspace status is Active in the AMG console.
• Confirm the IAM policy resource ARN isn’t restricted to a different workspace.

​

No Prometheus data source found

• In your AMG workspace, verify a Prometheus or AMP data source is configured.
• Go to workspace Configuration → Data sources and add one if missing.
• If using AMP, ensure the AMP workspace is in the same region.

​

Metrics returning empty

• Verify your OTel collector is running and sending data to AMP or CloudWatch.
• Check the AMP workspace has received data: go to AMP console → Rule groups namespaces to see if metrics are being ingested.
• In AMG, try a simple query like up in the Explore tab to verify the data source works.