Connect to an AWS IoT TwinMaker data source

The AWS IoT TwinMaker feature is in preview release for Amazon Managed Grafana and is subject to change.

Note

In workspaces that support version 9 or newer, this data source might require you to install the appropriate plugin. For more information, see Extend your workspace with plugins.

With Amazon Managed Grafana, you can add AWS IoT TwinMaker, a powerful industrial data analytics service, as an app and data source in your Grafana workspace. With AWS IoT TwinMaker, you can create end-user 3D digital twin applications to monitor industrial operations. The AWS IoT TwinMaker is a service that makes it faster for developers to create digital replicas of real-world systems, helping more customers realize the potential of digital twins to optimize operations. The AWS IoT TwinMaker for Grafana provides custom panels, dashboard templates, and a data source to connect to your digital twin data.

To enable the AWS IoT TwinMaker plugin

To enable AWS IoT TwinMaker as a data source

1. Open the Amazon Managed Grafana console at https://console.aws.amazon.com/grafana/.

2. In the navigation pane, choose All workspaces and choose the workspace you are working in. This opens the Grafana console for your workspace.

3. In the Grafana console, choose the Configuration (gear) icon.

4. Choose Enable in the Config tab.

Adding the permission for AWS IoT TwinMaker to your workspace user role

To add permissions for AWS IoT TwinMaker to your workspace user role, assume role permission between Amazon Managed Grafana workspace and TwinMaker dashboard roles.

1. Go to https://console.aws.amazon.com/iam/.

2. Manually create a dashboard role. For more information about creating a dashboard role, see To manually create a Grafana AWS IoT TwinMaker dashboard role.

AWS IoT TwinMaker connection details settings

Configure connection details settings

1. In the Connection Details menu, select the authentication provider (recommended: Workspace IAM Role).

2. Choose the Default Region you want to query.

3. In the TwinMaker settings, enter the AWS IoT TwinMaker workspace name.

To manually create a Grafana AWS IoT TwinMaker dashboard role

To manually create a Grafana AWS IoT TwinMaker dashboard role

1. Sign in to the IAM console at https://console.aws.amazon.com/iam/.

2. Locate your Amazon Managed Grafana workspace role in the summary. It appears as follows:

    AmazonGrafanaServiceRole-random_ID

3. Add the following inline policy to the role:

   {
       "Version": "2012-10-17",
       "Statement": {
           "Effect": "Allow",
           "Action": "sts:AssumeRole",
           "Resource": "< TwinMaker Dashboard Role ARN >"
       }
   }

4. Add a new inline policy for each dashboard role. Alternatively, add a list of role Amazon Resource Names (ARNs) on the Resource line.

5. Find your dashboard role in the IAM console. It should have a SceneViewer policy and, optionally, a VideoPlayer policy.

6. Choose the Trust relationship tab.

7. Choose Edit trust relationship.

8. Enter the following policy, replacing AMGWorkspaceRoleArn with the Arn from your account:

   
      {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": "AMGWorkspaceRoleARN"
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }
     

Example of an AWS IoT TwinMaker policy

The following is a minimal AWS IoT TwinMaker policy that you can attach to a dashboard role. You must replace the values for the AWS IoT TwinMaker workspace ARN and ID, as well as the Amazon S3 bucket ARN, based on your own resources.

 {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": [
          "iottwinmaker:ListWorkspaces"
        ],
        "Resource": [
          "*"
        ],
        "Effect": "Allow"
      },
      {
        "Action": [
          "iottwinmaker:Get*",
          "iottwinmaker:List*"
        ],
        "Resource": [
          "IoTWorkspaceArn",
          "IoTWorkspaceArn/*"
        ],
        "Effect": "Allow"
      },
      {
        "Action": [
          "kinesisvideo:Describe*",
          "kinesisvideo:Get*",
          "kinesisvideo:List*"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": [
          "iotsitewise:Describe*",
          "iotsitewise:List*",
          "iotsitewise:Get*"
        ],
        "Resource": "*",
        "Effect": "Allow"
      },
      {
        "Action": "iotsitewise:BatchPutAssetPropertyValue",
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
          "StringEquals": {
            "aws:ResourceTag/IoTWorkspaceId": "SiteWatch"
          }
        }
      },
      {
        "Effect": "Allow",
        "Action": ["s3:GetObject"],
        "Resource": [
          "S3BucketArn", 
          "S3BucketArn/*"
        ]
      }
    ]
  }