---
title: "Create an AWS IAM role | Grafana Labs"
description: "Learn how to create the required AWS IAM role and policies to allow Grafana Cloud to access your AWS metrics."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Create an AWS IAM role

In this milestone, you’ll create an AWS IAM role that grants Grafana Cloud the necessary permissions to collect metrics from your AWS account. This role uses the principle of least privilege, providing only the read-only access required for monitoring.

The IAM role establishes a secure trust relationship between your AWS account and Grafana Cloud, allowing metric collection without sharing long-term credentials or compromising security.

You can configure the AWS role automatically with CloudFormation or Terraform, or manually in the AWS Management Console. This milestone uses CloudFormation, the recommended approach.

1. From the **Configuration** tab, click the **AWS accounts** tile.
2. On the **AWS accounts** page, click **Add new account** to open the **Create new account** page.
3. For **Create a new AWS role**, leave the **Automatically** and **Use CloudFormation** tiles selected.
4. Click **Launch stack** to open a CloudFormation template in your AWS account in a new tab.
   
   The AWS account you’re logged into when you click this button is the account that opens. To use a different account, log out of the current account and log in to the account you want to use.

Complete the remaining steps in the AWS console tab, then return to Grafana Cloud:

1. Select the **I acknowledge that AWS CloudFormation might create IAM resources with custom names** checkbox.
2. Click **Create stack**.
3. Copy the `RoleARN` in the **Outputs** tab of the stack to use in the next milestone.
4. Return to the **Create new account** page in Grafana Cloud when you have finished in AWS.

You created a read-only AWS IAM role and copied its role ARN for the next milestone.

In your next milestone, you’ll use this IAM role to connect your AWS account to Grafana Cloud.

* * *

### More to explore (optional)

- [Additional ways to create an AWS IAM role](/docs/grafana-cloud/monitor-infrastructure/monitor-cloud-provider/aws/cloudwatch-metrics/config-cw-metric-scrape/#create-an-aws-iam-role)