In this video, you’ll see how to connect Amazon
Virtual Private Cloud (Amazon VPC) data sources with Amazon Managed Grafana.
With this capability, you can create an Amazon Managed Grafana workspace,
connect it to a data source in an Amazon VPC, and then query the
VPC data source using Amazon Managed Grafana.
We’ll begin in Amazon Managed Grafana, where we’ll create a new workspace.
Let’s name the workspace.
We’ll choose AWS IAM Identity Center for the authentication method.
We’ll use the default service managed permission type.
Next, we'll select an outbound VPC connection.
For this example, we’ll use a VPC that already has an OpenSearch Service domain configured.
Next, we’ll select two subnets to map the Availability Zones for our VPC.
We’ll select a security group and continue.
We’ll select Amazon OpenSearch Service as our data source.
For the notification channel, we’ll use Amazon SNS.
Let’s create the workspace.
While the workspace is being created,
let's navigate to the Amazon OpenSearch Service console.
For the purposes of this demo, we already have an OpenSearch Service domain.
Let’s view it.
The OpenSearch Service domain is only accessible in a VPC,
so opening the URL will time out.
The domain has a Security Group,
which allows Grafana security groups to access the cluster.
Let’s drill down to view its rules.
The security group has two inbound rules.
One gives domain access to Grafana, and the other gives domain access to a
bastion host on Amazon Elastic Compute Cloud (Amazon EC2).
Let’s navigate to the EC2 Management console and find the host instance.
We’ll copy the OpenSearch Dashboards URL so we can use it to verify connectivity.
Let’s try connecting to the domain.
The bastion host has access to the domain on a network level,
so we can use port forwarding to forward the local traffic to OpenSearch.
Before we can forward traffic, we’ll need to give the security groups SSH access to the instance.
We’ll edit the bastion security group’s inbound rules to authorize SSH access on our local IP.
Now we’ll run a command to start forwarding the traffic.
Now, let’s open the OpenSearch Dashboard on localhost.
We'll add some sample flight data that we can search for in Grafana.
Next, we’ll view the security roles.
Next, we’ll set up an OpenSearch role for Grafana users.
Let’s return to the Grafana console.
Our workspace has been created successfully.
The Network Access Control tab displays the VPC settings we configured earlier.
Let’s copy the IAM role for the workspace and return to OpenSearch.
On the OpenSearch Dashboard, we’ll select the all_access role and map a user.
We’ll map the backend role to the IAM role we just copied.
The Grafana workspace now has access to
OpenSearch on the network level and at the authentication layer level.
Next, let's assign a user to connect to Grafana and configure OpenSearch connectivity.
For demonstration purposes, we have one user.
Let’s assign the user access to Grafana,
and make them an Admin so they can perform all actions.
Next, we’ll open Grafana and sign in with AWS IAM Identity Center.
Let’s add the OpenSearch data source.
For the domain URL, we’ll go to the OpenSearch console and copy the domain endpoint.
We’ll select SigV4 authentication, which will use
the Grafana IAM role to connect to the index through the OpenSearch mapping.
Next, we’ll select the default region.
Next, we’ll need the OpenSearch index name.
We can retrieve this from the OpenSearch Dashboard.
We’ll navigate to the Discover dashboard.
We’ll copy the index name.
When entering details, it’s important not to include additional spaces.
Next, we’ll specify the time field name.
On the OpenSearch Dashboard Discover page, we can view all detected fields in the left pane.
We’ll use the timestamp field.
Now, we'll save and test the data source.
The data source is now connected.
On the Data Sources page, we can see that OpenSearch is configured for our private domain.
On the Explore page, OpenSearch is available as a data source we can query.
Let's run a query using PPL.
We’ll query to return the index with our sample data flights.
The OpenSearch Service data in our VPC has been retrieved and can be
used in Amazon Managed Grafana.
You've just seen how to connect Amazon VPC data sources with Amazon Managed Grafana.
You can learn more about this topic in the description and links for this video.
Thanks for watching. Now it’s your turn to try.