---
title: "Configure authentication and region | Grafana Labs"
description: "Select the Grafana Assume Role authentication method and set the default AWS region for the data source."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Configure authentication and region

On the CloudWatch **Settings** tab, you choose how Grafana authenticates to AWS and which region it queries. This path uses **Grafana Assume Role**, a keyless method available in Grafana Cloud that lets Grafana access your AWS account through a trusted IAM role instead of long-lived access keys.

In Grafana Cloud, the **Authentication Provider** offers two options: **Grafana Assume Role** and **Access & secret key**. Grafana Assume Role is usually preselected.

1. Under **Authentication > Authentication Provider**, make sure **Grafana Assume Role** is selected.
   
   This is the recommended method for Grafana Cloud — it avoids storing AWS access keys in Grafana.
2. Under **Additional Settings > Default Region**, select the AWS region where your CloudWatch data lives, such as `us-east-1`.
   
   This is the region Grafana queries unless you override it in an individual panel.

Leave the **Settings** tab open. In the next milestone, you’ll create the IAM role in AWS that Grafana Assume Role relies on and paste its ARN here.