Creating a workspace - Amazon Managed Grafana

Creating a workspace

A workspace is a logical Grafana server. You can have as many as five workspaces in each Region in your account.

User authentication in a workspace

For user authentication, Amazon Managed Grafana supports the following options:

  • User credentials stored in identity providers (IdPs), with authentication by Security Assertion Markup Language 2.0 (SAML 2.0)

  • AWS Single Sign-On

SAML

If you use SAML, your users must already be created in an identity provider. Amazon Managed Grafana supports any identity provider that supports SAML 2.0. For more information, see Using SAML with your Amazon Managed Grafana workspace.

AWS SSO

When you create a workspace and choose to use AWS SSO for authentication, Amazon Managed Grafana activates AWS SSO in your account if you are not already using it. For more information about AWS SSO, see What is AWS Single Sign-On.

To use AWS SSO with Amazon Managed Grafana, you must also have AWS Organizations activated in your account. If you don't have it activated already, Amazon Managed Grafana activates it when it activates AWS SSO. If Amazon Managed Grafana enables Organizations, it also creates an organization for you. For more information about Organizations, see What is AWS Organizations.

Note

To create a workspace in an account that is already a member of an AWS organization, AWS SSO must be enabled in the management account of the organization. If you enabled AWS SSO in the management account before November 25, 2019, you must also enable AWS SSO-integrated applications in the management account. For more information, see AWS SSO-integrated applications.

Necessary permissions

To create a workspace that uses an IdP and SAML for authorization, you must be signed on to an AWS Identity and Access Management (IAM) principal that has the AWSGrafanaAccountAdministrator policy attached.

To create your first workspace that uses AWS SSO for authorization, you must be signed on to an IAM principal that has at least the following policies attached:

  • AWSGrafanaAccountAdministrator

  • AWSSSOMemberAccountAdministrator

  • AWSSSODirectoryAdministrator

For more information, see Create and manage Amazon Managed Grafana workspaces and users in a single standalone account using AWS SSO.

To create a workspace, follow these steps.

To create a workspace in Amazon Managed Grafana

  1. Open the Amazon Managed Grafana console at https://console.aws.amazon.com/grafana/.

  2. Choose Create workspace.

  3. For Workspace name, enter a name for the workspace.

    Optionally, enter a description for the workspace.

  4. Choose Next.

  5. For Authentication access, select AWS Single Sign-On (AWS SSO), Security Assertion Markup Language (SAML), or both.

    • AWS SSO — If you select AWS SSO and you have not already enabled AWS Single Sign-On in your account, you are prompted to enable it by creating your first AWS SSO user. AWS SSO handles user management for access to Amazon Managed Grafana workspaces.

      To enable AWS SSO, follow these steps:

    1. Choose Create user.

    2. Enter an email address, first name, and last name for the user, and choose Create user. For this tutorial, use the name and email address of the account that you want to use to try out Amazon Managed Grafana. You will receive an email message prompting you to create a password for this account for AWS SSO.

    Important

    The user that you create does not automatically have access to your Amazon Managed Grafana workspace. You provide the user with access to the workspace in the workspace details page in a later step.

    • SAML — If you select SAML, you will complete the SAML setup after the workspace is created.

  6. Choose Service managed or Customer managed, and then choose Next.

    If you choose Service managed, Amazon Managed Grafana automatically creates the IAM roles and provisions the permissions that you need for the AWS data sources in this account that you choose to use for this workspace.

    If you want to manage these roles and permissions yourself, choose Customer managed.

    If you are creating a workspace in a member account of an organization, to be able to choose Service managed the member account must be a delegated administrator account in an organization. For more information about delegated administrator accounts, see Register a delegated administrator.

  7. If you chose Service managed, choose Current account to have Amazon Managed Grafana automatically create policies and permissions that allow it to read AWS data only in the current account.

    If you are creating a workspace in the management account or a delegated administrator account in an organization, you can choose Organization to have Amazon Managed Grafana automatically create policies and permissions that allow it to read AWS data in other accounts in the organizational units that you specify. For more information about delegated administrator accounts, see Register a delegated administrator.

    Note

    Creating resources such as Amazon Managed Grafana workspaces in the management account of an organization is against AWS security best practices.

    1. If you chose Organization, and you are prompted to enable AWS CloudFormation StackSets, choose Enable trusted access. Then, add the AWS Organizations organizational units (OUs) that you want Amazon Managed Grafana to read data from. Amazon Managed Grafana can then read data from all accounts in each OU that you choose.

    2. If you chose Organization, choose Data sources and notification channels - optional.

  8. Select the AWS data sources that you want to query in this workspace. Selecting data sources enables Amazon Managed Grafana to create IAM roles and permissions that allow Amazon Managed Grafana to read data from these sources. You must still add the data sources in the Grafana workspace console.

  9. (Optional) If you want Grafana alerts from this workspace to be sent to an Amazon Simple Notification Service (Amazon SNS) notification channel, select Amazon SNS. This enables Amazon Managed Grafana to create an IAM policy to publish to the Amazon SNS topics in your account with TopicName values that start with grafana. This does not completely set up Amazon SNS as a notification channel for the workspace. You can do that within the Grafana console in the workspace.

  10. Choose Next.

  11. Confirm the workspace details, and choose Create workspace.

    The workspace details page appears.

    Initially, the Status is CREATING.

    Important

    Wait until the status is ACTIVE before doing either of the following:

    • Completing the SAML setup, if you are using SAML.

    • Assigning your AWS SSO users access to the workspace, if you are using AWS SSO.

    You might need to refresh your browser to see the current status.

  12. If you are using AWS SSO, do the following:

    1. In the Authentication tab, choose Assign new user or group.

    2. Select the check box next to the user that you want to grant workspace access to, and choose Assign user.

    3. Select the check box next to the user, and choose Make admin.

      Important

      Assign at least one user as Admin for each workspace, in order to sign in to the Grafana workspace console to manage the workspace.

  13. If you are using SAML, do the following:

    1. In the Authentication tab, under Security Assertion Markup Language (SAML), choose Complete setup.

    2. For Import method, do one of the following:

      • Choose URL and enter the URL of the IdP metadata.

      • Choose Upload or copy/paste. If you are uploading the metadata, choose Choose file and select the metadata file. Or, if you are using copy and paste, copy the metadata into Import the metadata.

    3. For Assertion attribute role, enter the name of the SAML assertion attribute from which to extract role information.

    4. For Admin role values, either enter the user roles from your IdP who should all be granted the Admin role in the Amazon Managed Grafana workspace, or select I want to opt-out of assigning admins to my workspace.

      Note

      If you choose I want to opt-out of assigning admins to my workspace., you won't be able to use the console to administer the workspace, including tasks such as managing data sources, users, and dashboard permissions. You can make administrative changes to the workspace only by using Amazon Managed Grafana APIs.

    5. (Optional) To enter additional SAML settings, choose Additional settings and do one or more the following. All of these fields are optional.

      • For Assertion attribute name, specify the name of the attribute within the SAML assertion to use for the user full "friendly" names for SAML users.

      • For Assertion attribute login, specify the name of the attribute within the SAML assertion to use for the user sign-in names for SAML users.

      • For Assertion attribute email, specify the name of the attribute within the SAML assertion to use for the user email names for SAML users.

      • For Login validity duration (in minutes), specify how long a SAML user's sign-in is valid before the user must sign in again. The default is 1 day, and the maximum is 30 days.

      • For Assertion attribute organization, specify the name of the attribute within the SAML assertion to use for the "friendly" name for user organizations.

      • For Assertion attribute groups, specify the name of the attribute within the SAML assertion to use for the "friendly" name for user groups.

      • For Allowed organizations, you can limit user access to only the users who are members of certain organizations in the IdP. Enter one or more organizations to allow, separating them with commas.

      • For Editor role values, enter the user roles from your IdP who should all be granted the Editor role in the Amazon Managed Grafana workspace. Enter one or more roles, separated by commas.

    6. Choose Save SAML configuration.

  14. In the workspace details page, choose the URL displayed under Grafana workspace URL.

  15. Choosing the workspace URL takes you to the landing page for the Grafana workspace console. Do one of the following:

    • Choose Sign in with SAML, and enter the name and password.

    • Choose Sign in with AWS SSO, and enter the email address and password of the user that you created earlier in this procedure. These credentials only work if you have responded to the email from Amazon Managed Grafana that prompted you to create a password for AWS SSO.

      You are now in your Grafana workspace, or logical Grafana server. You can start adding data sources to query, visualize, and analyze data. For more information, see Working in your Grafana workspace.