Using AWS IAM Identity Center (successor to AWS Single Sign-On) with your Amazon Managed Grafana workspace
Amazon Managed Grafana integrates with AWS IAM Identity Center (successor to AWS Single Sign-On) to provide identity federation for your workforce. Using Amazon Managed Grafana and AWS IAM Identity Center (successor to AWS Single Sign-On), users are redirected to their existing company directory to sign in with their existing credentials. Then, they are seamlessly signed in to their Amazon Managed Grafana workspace. This ensures that security settings such as password policies and two-factor authentication are enforced. Using IAM Identity Center does not impact your existing IAM configuration.
If you do not have an existing user directory or prefer not to federate, IAM Identity Center offers an integrated user directory that you can use to create users and groups for Amazon Managed Grafana. Amazon Managed Grafana does not support the use of IAM users and roles to assign permissions within an Amazon Managed Grafana workspace.
For more information about IAM Identity Center, see What is AWS IAM Identity Center (successor to AWS Single Sign-On). For more information about getting started with IAM Identity Center, see Getting started.
To use IAM Identity Center, you must also have AWS Organizations activated for the account. If needed, Amazon Managed Grafana can activate Organizations for you when you create your first workspace that is configured to use IAM Identity Center.
Required permissions for scenarios using IAM Identity Center
This section explains the policies that are required for several scenarios for using Amazon Managed Grafana with IAM Identity Center.
Grafana administrator in a management account using IAM Identity Center
To grant permissions to create and manage Amazon Managed Grafana workspaces across an entire organization, and to allow dependencies such as IAM Identity Center, assign the AWSGrafanaAccountAdministrator, AWSSSOMasterAccountAdministrator and the AWSSSODirectoryAdministrator policies to a user. Additionally, to upgrade an Amazon Managed Grafana workspace to Grafana Enterprise, a user must have the AWSMarketplaceManageSubscriptions IAM policy or the equivalent permissions.
If you want to use service-managed permissions when you create an Amazon Managed Grafana workspace,
the user who creates the workspace must also have the iam:CreateRole
,
iam:CreatePolicy
, and iam:AttachRolePolicy
permissions. These
are required to use AWS CloudFormation StackSets to deploy policies that allow you to read data sources
in the organization's accounts.
Granting a user the iam:CreateRole
, iam:CreatePolicy
,
and iam:AttachRolePolicy
permissions gives that user full administrative
access to your AWS account. For example, a user with these permissions can
create a policy that has full permissions for all resources, and attach
that policy to any role. Be very careful about who you grant these permissions to.
To see the permissions granted to AWSGrafanaAccountAdministrator, see AWS managed policy: AWSGrafanaAccountAdministrator
Grafana administrator in a member account using IAM Identity Center
To grant permissions to create and manage Amazon Managed Grafana workspaces in the member account of an organization, assign the AWSGrafanaAccountAdministrator, AWSSSOMemberAccountAdministrator and the AWSSSODirectoryAdministrator policies to a user. Additionally, to upgrade an Amazon Managed Grafana workspace to Grafana Enterprise, a user must have the AWSMarketplaceManageSubscriptions IAM policy or the equivalent permissions.
If you want to use service-managed permissions when you create an Amazon Managed Grafana workspace,
the user who creates the workspace must also have the iam:CreateRole
, iam:CreatePolicy
,
and iam:AttachRolePolicy
permissions. These are required to enable the user
to read data sources in the account.
Granting a user the iam:CreateRole
, iam:CreatePolicy
,
and iam:AttachRolePolicy
permissions gives that user full administrative
access to your AWS account. For example, a user with these permissions can
create a policy that has full permissions for all resources, and attach
that policy to any role. Be very careful about who you grant these permissions to.
To see the permissions granted to AWSGrafanaAccountAdministrator, see AWS managed policy: AWSGrafanaAccountAdministrator
Create and manage Amazon Managed Grafana workspaces and users in a single standalone account using AWS IAM Identity Center (successor to AWS Single Sign-On)
A standalone AWS account is an account that is not yet a member of an organization. For more information about organizations, see What is AWS Organizations?
To grant permission to create and manage Amazon Managed Grafana workspaces and users in a standalone account, assign the AWSGrafanaAccountAdministrator, AWSSSOMasterAccountAdministrator, AWSOrganizationsFullAccess and AWSSSODirectoryAdministrator policies to a user. Additionally, to upgrade an Amazon Managed Grafana workspace to Grafana Enterprise, a user must have the AWSMarketplaceManageSubscriptions IAM policy or the equivalent permissions.
Granting a user the iam:CreateRole
, iam:CreatePolicy
,
and iam:AttachRolePolicy
permissions gives that user full administrative
access to your AWS account. For example, a user with these permissions can
create a policy that has full permissions for all resources, and attach
that policy to any role. Be very careful about who you grant these permissions to.
To see the permissions granted to AWSGrafanaAccountAdministrator, see AWS managed policy: AWSGrafanaAccountAdministrator