AWS Managed Grafana workspace cannot be configured with Athena workgroup

Question

Dear members of the AWS community,

I have been facing an issue for the past couple of days trying to setup AWS Managed Grafana workspace with Athena workgroup.

The underlying reason why I want to do this is to visualize the cost of my AWS infrastructure in Grafana. For that, I have been following this comprehensive guide https://aws.amazon.com/blogs/mt/visualize-and-gain-insights-into-your-aws-cost-and-usage-with-amazon-managed-grafana/.

I believe the problem I’m encountering is permissions. The reason is because when I try to configure a new connection to Athena workgroup, I can see no workgroups available in any region.

However, I checked the IAM service role from Grafana, and it does have this managed AWS policy `AmazonGrafanaAthenaAccess` , which has the following permissions:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "athena:GetDatabase",
                "athena:GetDataCatalog",
                "athena:GetTableMetadata",
                "athena:ListDatabases",
                "athena:ListDataCatalogs",
                "athena:ListTableMetadata",
                "athena:ListWorkGroups"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "athena:GetQueryExecution",
                "athena:GetQueryResults",
                "athena:GetWorkGroup",
                "athena:StartQueryExecution",
                "athena:StopQueryExecution"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "Null": {
                    "aws:ResourceTag/GrafanaDataSource": "false"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "glue:GetDatabase",
                "glue:GetDatabases",
                "glue:GetTable",
                "glue:GetTables",
                "glue:GetPartition",
                "glue:GetPartitions",
                "glue:BatchGetPartition"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads",
                "s3:ListMultipartUploadParts",
                "s3:AbortMultipartUpload",
                "s3:CreateBucket",
                "s3:PutObject",
                "s3:PutBucketPublicAccessBlock"
            ],
            "Resource": [
                "arn:aws:s3:::grafana-athena-query-results-*"
            ]
        }
    ]
}
```

Would appreciate some shed of light in this issue.

Best

Ed

Deeksha · Answer

1. Check the Athena Workgroup and Region:

Ensure that the Athena workgroup exists in the region you are working with and that you are accessing the correct region from Grafana.

2. Verify the IAM Role:

Double-check that the IAM role associated with your Grafana workspace has the AmazonGrafanaAthenaAccess policy attached.
Ensure that no deny policies or Service Control Policies (SCPs) are affecting this role’s permissions.

3. Check S3 Permissions:

Ensure the S3 bucket permissions (grafana-athena-query-results-*) are properly configured. This bucket is where Athena stores query results, and Grafana needs access to it to retrieve the data.

4. Test with AWS CLI:

Use the AWS CLI with the same IAM role (assume the role if necessary) to list the Athena workgroups:

```
aws athena list-work-groups --region 
```

This will help you verify if the IAM role has the necessary permissions to list the workgroups.

5. Create a New Policy with Explicit Permissions:

If the managed policy is not working as expected, try creating a custom policy that explicitly allows access to the specific Athena workgroup and resources you are trying to use.

6. Region-Specific Issues:

Ensure that the Athena workgroup and the Grafana workspace are both in the same region, or that you are selecting the correct region when setting up the data source in Grafana.

Giovanni Lauria · Answer

The issue with AWS Managed Grafana not showing Athena workgroups could be due to region mismatches, incorrect IAM role permissions, or misconfiguration in Grafana.

Ensure that Athena workgroups and Grafana are in the same region, verify that the IAM role has the right permissions, and double-check Grafana's settings.

Also, review any service limits.

AWS Managed Grafana workspace cannot be configured with Athena workgroup

Relevant content