In this video, you’ll see how to create
persona-based operational dashboards in Amazon Managed Grafana.
Using this service, you can isolate operational data to appropriate personas,
create observability for users without granting privileged access to production
accounts, and break operating silos with cross-cutting visualizations.
Let’s start by navigating to the AWS account that will host our Grafana dashboards.
From this account, we’ll open Amazon Managed Grafana.
With Amazon Managed Grafana, you can query, visualize, and understand
your metrics no matter where they’re stored.
Let’s create a workspace.
First, we’ll give the workspace a name.
Note that at least one authentication method must be enabled to log into this workspace.
We’ll choose AWS Single Sign-On (SSO).
Next, we can select data sources.
This will create an IAM role that enables
Amazon Managed Grafana to access those resources in the current account.
For our purposes, we’ll select AWS X-Ray and Amazon CloudWatch.
Next, we’ll review the settings and create the workspace.
Now that the workspace has been created successfully, we can assign
a user or user group to it.
For the purposes of this example, we’ve already created three user groups.
Let’s assign them to this workspace.
By default, the user groups have viewer permissions.
Let’s assign admin permissions to the Domain Admins group.
Now let’s return to the AWS SSO portal to sign in to the Grafana workspace.
To view the workspace, we’ll reload the page.
This is the default view for a new Grafana workspace.
Let’s add data sources.
More than 40 data sources are currently available in Amazon Managed Grafana.
First, we’ll add AWS X-Ray.
For our purposes, we’ll use the Workspace IAM role as the authentication provider.
For the default region, we’ll select us-east-1.
Let’s save and test the settings.
Next, we’ll add CloudWatch as a data source.
Again, we’ll use the Workspace IAM role and set the default region to us-east-1.
We can link our X-Ray data source so that Grafana will automatically add links
to our logs when they contain the @xrayTraceId field.
Let’s save and test the settings.
Next, let’s create a custom dashboard for infrastructure operations users.
We’ll add a new panel.
Let’s configure CloudWatch as the data source.
We’ll query for metrics in the AWS/EC2 namespace with a name of CPUUtilization.
Let’s add a dimension to target a specific Auto Scaling group.
For our purposes, we’ll choose an EKS cluster within this account.
Now let’s configure the appearance of the panel.
We’ll start by giving the panel a title and description.
We can select values or calculations to show in the legend.
For this example, we’ll choose the last value and maximum value.
We can also change the graph style between lines, bars, and points.
We’ll select Lines and set the line interpolation to smooth.
We’ll also choose to always connect null values.
Additionally, we can choose a specific unit of measurement.
In this case, we’ll set the unit to percent.
Finally, let’s add a threshold to the visualization so users can see when
data is higher than expected.
We’ll show the threshold as a line.
Now let’s apply our changes.
For the purposes of this example,
we’ve skipped ahead to when more data has been added to our dashboard.
Let’s name our dashboard Infrastructure Ops and save it.
Now let’s create a dashboard for DevOps users.
We’ll skip ahead to when the dashboard is complete.
Now let’s see how we can grant permissions in Grafana to a team of users.
We’ll create a team called InfraOps.
We can automatically synchronize team membership between our Grafana
workspace and our authorization provider.
Let’s add an external authorization provider group.
The group has been added.
Now, as members of this external group are added or removed, the members in
our Grafana team will update accordingly.
Next, let’s create a DevOps team.
We’ll also sync this team with an external group.
Now let’s configure access permissions for each of our dashboards.
First, we’ll set the permissions for our Infrastructure Ops dashboard.
We’ll give view-only permissions to the InfraOps team we created.
Let’s remove the default editor and viewer roles and save our changes.
Next, let’s add permissions for the DevOps dashboard.
We’ll add permissions for the DevOps team we created.
Again, we’ll remove the default editor and viewer roles.
Now let’s ensure that the appropriate permissions have been granted.
To do so, we’ll first sign out of this Grafana workspace.
Next, we’ll sign in to a DevOps user account.
We can see the Grafana workspace that we created earlier.
Let’s open it.
We’ll browse the available dashboards.
We can access the DevOps dashboard we created but not the Infrastructure
Ops dashboard, indicating the appropriate permissions have been granted.
Now let’s sign out and switch to an Infraops user account.
We’ll open the Grafana workspace and browse to the available dashboards.
As expected, this account has been
provided with access to only the Infrastructure Ops dashboard.
You've just learned how to create persona-based operational dashboards
in Amazon Managed Grafana.
You can learn more about this topic in the description and links for this video.
Thanks for watching. Now it's your turn to try.