Can I use a custom domain with my Amazon Managed Grafana workspace?

Symptoms

• You created a CNAME record in your internal DNS that points to the workspace endpoint (g-1a2b3c4d5e.grafana-workspace.<region>.amazonaws.com), but accessing the workspace through your internal domain returns an SSL/TLS certificate error or the page does not load correctly.
• You cannot find a console setting that lets you change the workspace URL to a custom domain.

Root cause

Amazon Managed Grafana does not currently support assigning a custom domain (internal DNS) to the workspace endpoint. Simply adding a CNAME record in your internal DNS will not work, for the following reasons:

• The SSL/TLS certificate of an AMG workspace is issued for *.grafana-workspace.<region>.amazonaws.com.
• You cannot attach your own custom AWS Certificate Manager (ACM) certificate to the workspace.

As a result, when you access the workspace through an internal domain, the hostname on the certificate that the browser receives does not match the requested domain (hostname mismatch), so you cannot establish a valid HTTPS connection for the custom domain.

Resolution and current state

You must use the g-1a2b3c4d5e.grafana-workspace.<region>.amazonaws.com URL that was issued for the workspace. The workspace settings do not provide an option to change the endpoint or domain.

A feature request for custom domain support is tracked on the Amazon Managed Grafana public roadmap and is being reviewed by the service team. However, there is no committed availability date, so for now you must use the issued workspace URL as described above.

Note: If access through an internal domain is strictly required, you can consider placing an Application Load Balancer (ALB) or Amazon CloudFront in front of the workspace as a reverse proxy, applying a separate ACM certificate for your internal domain to that proxy, and pointing your internal DNS to the proxy instead of the workspace endpoint. However, this configuration is not officially supported by Amazon Managed Grafana, and it requires additional setup and testing depending on your environment. In particular, because AMG performs login authentication redirects based on the original workspace endpoint when you sign in through SAML or IAM Identity Center, you must separately verify that the login authentication flow works correctly when using a proxy.

Related information

• Support for Custom Domains (Amazon Managed Grafana roadmap)
• Configure an Amazon Managed Grafana workspace
• Redirect one domain to another in Route 53
• Configure CloudFront content with CNAME over HTTPS