> ## Documentation Index
> Fetch the complete documentation index at: https://docs.obsy.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Managed Grafana

> Connect Amazon Managed Grafana for dashboards, alerts, and metrics powered by CloudWatch, X-Ray, and AMP.

See [Connect an observability platform](/getting-started/connect-platform) for initial setup during onboarding.

***

## What the AWS Managed Grafana integration enables

| Feature                               | Requires                                       |
| ------------------------------------- | ---------------------------------------------- |
| OTel health reports (PromQL via AMP)  | IAM user with `grafana:*` permission           |
| Golden signals metrics                | Prometheus data source configured in workspace |
| Create dashboards                     | IAM user with `grafana:*` permission           |
| Create alert rules                    | IAM user with `grafana:*` permission           |
| Service discovery                     | Prometheus/Tempo data sources configured       |
| OTel data export (CloudWatch + X-Ray) | SigV4 auth via IAM credentials                 |

***

## How it works

Amazon Managed Grafana (AMG) is a fully managed Grafana service that natively integrates with AWS observability services:

* **Amazon CloudWatch** — metrics and logs from AWS services and your applications
* **AWS X-Ray** — distributed tracing
* **Amazon Managed Prometheus (AMP)** — PromQL-compatible metrics storage for custom application metrics

Obsy connects to your AMG workspace using AWS IAM credentials and SigV4 authentication. It uses the same Grafana HTTP API as Grafana Cloud, so you get full dashboard, alerting, and metrics capabilities — all running inside your AWS account.

***

## Prerequisites

* An AWS account
* An Amazon Managed Grafana workspace (or you'll create one during setup)
* An IAM user or role with `grafana:*` permissions on the workspace
* Optionally: an Amazon Managed Prometheus workspace for application metrics

***

## Step 1: Create a Managed Grafana workspace

<Note>
  Skip this step if you already have an AMG workspace.
</Note>

1. Open the [Amazon Managed Grafana console](https://console.aws.amazon.com/grafana/home).
2. Click **Create workspace**.
3. Enter a name (e.g., `obsy-workspace`) and click **Next**.
4. For authentication, select **AWS IAM Identity Center (SSO)** or **SAML** — either works.
5. Under **Data sources**, enable:
   * **Amazon CloudWatch** — for AWS infrastructure metrics
   * **AWS X-Ray** — for distributed tracing
   * **Amazon Managed Service for Prometheus** (optional) — for custom app metrics
6. Review and click **Create workspace**.
7. Wait for the workspace status to become **Active**.
8. Copy the **Workspace ID** — it starts with `g-` (e.g., `g-abc123def4`).

***

## Step 2: Create an IAM user for Obsy

Obsy needs programmatic access to your workspace via the Grafana HTTP API.

1. Go to [IAM Console → Users](https://console.aws.amazon.com/iam/home#/users).
2. Click **Create user**, name it `obsy-grafana-access`.
3. Select **Attach policies directly**.
4. Click **Create policy** and paste this JSON:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ObsyGrafanaAccess",
      "Effect": "Allow",
      "Action": "grafana:*",
      "Resource": "arn:aws:grafana:*:*:/workspaces/*"
    }
  ]
}
```

5. Name the policy `ObsyGrafanaAccess` and attach it to the user.
6. After creating the user, go to the **Security credentials** tab.
7. Click **Create access key** → select **Third-party service** as the use case.
8. Copy both the **Access Key ID** and **Secret Access Key**.

<Warning>
  Save the secret access key immediately — AWS only shows it once. If you lose it, you'll need to create a new key pair.
</Warning>

***

## Step 3: Connect in Obsy

1. In Obsy, go to **Integrations** and click **Add Platform**.
2. Select **AWS Managed Grafana**.
3. Fill in:
   * **Region** — the AWS region where your workspace lives (e.g., `us-east-1`)
   * **Workspace ID** — starts with `g-` (from step 1)
   * **Access Key ID** — from step 2
   * **Secret Access Key** — from step 2
4. Optionally fill in:
   * **IAM Role ARN** — if your workspace is in a different account (see cross-account section below)
   * **AMP Workspace ID** — if you have Amazon Managed Prometheus set up (starts with `ws-`)
5. Click **Test Connection** to verify.
6. Click **Continue** or **Save**.

***

## Step 4 (Optional): Set up Amazon Managed Prometheus

AMP gives you PromQL-compatible storage for application metrics sent via OpenTelemetry. This is recommended for golden signals and SLO monitoring.

1. Open the [Amazon Managed Prometheus console](https://console.aws.amazon.com/prometheus/home).
2. Click **Create workspace**, give it a name (e.g., `obsy-metrics`).
3. Copy the **Workspace ID** (starts with `ws-`).
4. In your AMG workspace, AMP should appear automatically as a data source if you enabled it during workspace creation. If not, add it manually under **Configuration → Data sources → Add data source → Prometheus** with the AMP workspace endpoint URL.

The AMP workspace ID is entered in Obsy as the optional **AMP Workspace ID** field. This tells Obsy's OTel collector where to send Prometheus remote-write data.

***

## Cross-account access

If your AMG workspace is in a different AWS account than where Obsy runs:

1. In the **target account** (where the workspace lives), create an IAM role:
   * Name: `ObsyGrafanaCrossAccountRole`
   * Trust policy: allow the **source account** to assume this role
   * Permissions: attach the `ObsyGrafanaAccess` policy from step 2

2. In Obsy, enter the role ARN in the **IAM Role ARN** field (e.g., `arn:aws:iam::123456789012:role/ObsyGrafanaCrossAccountRole`).

3. Optionally set an **External ID** for additional security.

Obsy will call AWS STS `AssumeRole` to get temporary credentials before accessing the workspace.

***

## OTel collector export configuration

When you deploy the OTel collector through Obsy, it's configured to export telemetry to AWS using native OTLP endpoints:

| Signal        | Endpoint                                                                            | Auth  |
| ------------- | ----------------------------------------------------------------------------------- | ----- |
| Metrics       | `https://monitoring.{region}.amazonaws.com/v1/metrics`                              | SigV4 |
| Traces        | `https://xray.{region}.amazonaws.com`                                               | SigV4 |
| Logs          | `https://logs.{region}.amazonaws.com/v1/logs`                                       | SigV4 |
| Metrics (AMP) | `https://aps-workspaces.{region}.amazonaws.com/workspaces/{id}/api/v1/remote_write` | SigV4 |

This means your telemetry data stays within your AWS account — no data leaves your infrastructure.

***

## Updating or removing the connection

1. Go to **Integrations** → find the **AWS Managed Grafana** card.
2. Use **Edit** to update credentials or workspace configuration.
3. Use **Disconnect** to remove the connection.

<Warning>
  Disconnecting removes stored credentials from Obsy but does not delete dashboards or alert rules already created in your workspace.
</Warning>

***

## Troubleshooting

### "Authentication failed" error

* Verify the IAM user has the `grafana:*` policy attached.
* Check the access key is active (not disabled) in IAM Console → Security credentials.
* Ensure the region matches where the workspace is deployed.

### "Workspace not found" error

* Double-check the workspace ID starts with `g-`.
* Ensure the workspace status is **Active** in the AMG console.
* Confirm the IAM policy resource ARN isn't restricted to a different workspace.

### No Prometheus data source found

* In your AMG workspace, verify a Prometheus or AMP data source is configured.
* Go to workspace **Configuration → Data sources** and add one if missing.
* If using AMP, ensure the AMP workspace is in the same region.

### Metrics returning empty

* Verify your OTel collector is running and sending data to AMP or CloudWatch.
* Check the AMP workspace has received data: go to AMP console → **Rule groups namespaces** to see if metrics are being ingested.
* In AMG, try a simple query like `up` in the Explore tab to verify the data source works.