{"action":"created","issue":{"url":"https://api.github.com/repos/grafana/grafana/issues/6700","repository_url":"https://api.github.com/repos/grafana/grafana","labels_url":"https://api.github.com/repos/grafana/grafana/issues/6700/labels{/name}","comments_url":"https://api.github.com/repos/grafana/grafana/issues/6700/comments","events_url":"https://api.github.com/repos/grafana/grafana/issues/6700/events","html_url":"https://github.com/grafana/grafana/issues/6700","id":191551818,"number":6700,"title":"CloudWatch plugin does not manage IAM role inside ECS","user":{"login":"yesteph","id":1999342,"avatar_url":"https://avatars.githubusercontent.com/u/1999342?v=3","gravatar_id":"","url":"https://api.github.com/users/yesteph","html_url":"https://github.com/yesteph","followers_url":"https://api.github.com/users/yesteph/followers","following_url":"https://api.github.com/users/yesteph/following{/other_user}","gists_url":"https://api.github.com/users/yesteph/gists{/gist_id}","starred_url":"https://api.github.com/users/yesteph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yesteph/subscriptions","organizations_url":"https://api.github.com/users/yesteph/orgs","repos_url":"https://api.github.com/users/yesteph/repos","events_url":"https://api.github.com/users/yesteph/events{/privacy}","received_events_url":"https://api.github.com/users/yesteph/received_events","type":"User","site_admin":false},"labels":[{"id":284664093,"url":"https://api.github.com/repos/grafana/grafana/labels/datasource:%20CloudWatch","name":"datasource: CloudWatch","color":"009800","default":false},{"id":223098243,"url":"https://api.github.com/repos/grafana/grafana/labels/state:%20help%20wanted%20(PR)","name":"state: help wanted (PR)","color":"bfe5bf","default":false},{"id":81198721,"url":"https://api.github.com/repos/grafana/grafana/labels/type:%20feature%20request","name":"type: feature request","color":"dddddd","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-11-24T15:53:00Z","updated_at":"2016-11-25T10:10:28Z","closed_at":null,"body":"Hello,\r\n\r\nGrafana version : 3.1.1\r\nOS : ECS service (official grafana/grafana docker image)\r\nDataSource : RDS PostgreSQL\r\n\r\nI run grafana as an ECS service with official Docker image : grafana/grafana.\r\nThe ECS service \"grafana\" has an IAM role \"ecsGrafanaRole\".\r\nMy ECS service is running on ECS container instances (EC2 VM) with an instance role \"ecsInstanceRole\".\r\n\r\nMy problem is when running in an ECS task, grafana tries to retrieve permissions as if it was running on a standard EC2 VM, not like an ECS service. \r\nI conclude this because the grafana logs refers to ecsInstanceRole, not ecsGrafanaRole : \"AccessDenied: User: arn:aws:sts::XXXXXXXXX:assumed-role/ecsInstanceRole/i-XXXXXXX is not authorized to perform: cloudwatch:ListMetrics\"\r\n\r\nDocumentation  indicates CloudWatch plugin uses AWS SDK : \"Currently all access to CloudWatch is done server side by the Grafana backend using the official AWS SDK. If you grafana server is running on AWS you can use IAM Roles and authentication will be handled automatically.\"\r\n\r\nAWS documentation indicates the authentication on ECS should be transparent if a recent SDK is used (July 2016) : [http://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html#task-iam-roles-minimum-sdk](url). \r\n\r\nMaybe this is not the case ?\r\n\r\nTo get things working, I must update IAM policy of the ECS container instances which is bad!\r\n\r\nThank you."},"comment":{"url":"https://api.github.com/repos/grafana/grafana/issues/comments/262923147","html_url":"https://github.com/grafana/grafana/issues/6700#issuecomment-262923147","issue_url":"https://api.github.com/repos/grafana/grafana/issues/6700","id":262923147,"user":{"login":"yesteph","id":1999342,"avatar_url":"https://avatars.githubusercontent.com/u/1999342?v=3","gravatar_id":"","url":"https://api.github.com/users/yesteph","html_url":"https://github.com/yesteph","followers_url":"https://api.github.com/users/yesteph/followers","following_url":"https://api.github.com/users/yesteph/following{/other_user}","gists_url":"https://api.github.com/users/yesteph/gists{/gist_id}","starred_url":"https://api.github.com/users/yesteph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yesteph/subscriptions","organizations_url":"https://api.github.com/users/yesteph/orgs","repos_url":"https://api.github.com/users/yesteph/repos","events_url":"https://api.github.com/users/yesteph/events{/privacy}","received_events_url":"https://api.github.com/users/yesteph/received_events","type":"User","site_admin":false},"created_at":"2016-11-25T10:10:28Z","updated_at":"2016-11-25T10:10:28Z","body":"Yes, need to use ecsCredProvider."}}
{"actor":{"display_login":"yesteph"}}