---
title: "Set up the Grafana Assume Role | Grafana Labs"
description: "Create an IAM role in AWS that trusts Grafana and paste its ARN into the data source configuration."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Set up the Grafana Assume Role

With **Grafana Assume Role** selected, Grafana Cloud makes a Security Token Service (STS) request to generate temporary credentials for your AWS account. You create an IAM role that trusts Grafana’s AWS account, and Grafana assumes that role to read your CloudWatch data. No access keys are stored in Grafana.

On the CloudWatch **Settings** tab, under the **Assume Role** heading, expand **How to create an IAM role for grafana to assume** to reveal the **Grafana account ID** and **External ID** unique to your instance. You’ll enter both in the AWS Console. Select **Learn more about Grafana Assume Role** for the full reference.

### Create the IAM role in AWS

In a separate browser tab, open the [AWS IAM console](https://console.aws.amazon.com/iam/) and complete the following steps:

1. Create a new IAM role. Under **Trusted entity type**, select **Another AWS account**.
2. Enter the **Grafana account ID** from the Settings tab, and select **Require external ID**.
3. Enter the **External ID** from the Settings tab.
4. Attach the metrics, logs, or metrics-and-logs permissions policy you prepared earlier.
5. Give the role a name and description, then select **Create role**.
6. Open the new role and copy its **ARN** (for example, `arn:aws:iam::123456789012:role/grafana-cloudwatch`).

For full details and a sample trust relationship, refer to [Use Grafana Assume Role](/docs/grafana/latest/datasources/aws-cloudwatch/aws-authentication/#use-grafana-assume-role).

Back on the CloudWatch **Settings** tab, paste the role ARN you copied into the **Assume Role ARN** field.

In the next milestone, you’ll save the data source and test the connection to AWS.