AWS.Grafana reference

AssociateLicense

Source: src/AWS/Grafana/AssociateLicense.ts

Runtime binding for the AssociateLicense operation (IAM action grafana:AssociateLicense), scoped to one Workspace.

Assigns a Grafana Enterprise license to the workspace. Pass a valid Grafana Labs token as grafanaToken when upgrading to ENTERPRISE. Upgrading incurs additional fees. Provide the implementation with Effect.provide(AWS.Grafana.AssociateLicenseHttp).

AssociateLicense: Managing Licenses

const associateLicense = yield* Grafana.AssociateLicense(workspace);

const { workspace: ws } = yield* associateLicense({
  licenseType: "ENTERPRISE",
  grafanaToken: token,
});
// ws.licenseType → "ENTERPRISE"

CreateWorkspaceServiceAccount

Source: src/AWS/Grafana/CreateWorkspaceServiceAccount.ts

Runtime binding for the CreateWorkspaceServiceAccount operation (IAM action grafana:CreateWorkspaceServiceAccount), scoped to one Workspace.

Creates a Grafana service account in the workspace — a non-user identity for machine access to the Grafana HTTP API (dashboards, alerts, data sources). Mint API tokens for it with CreateWorkspaceServiceAccountToken. Requires Grafana 9 or newer. Provide the implementation with Effect.provide(AWS.Grafana.CreateWorkspaceServiceAccountHttp).

CreateWorkspaceServiceAccount: Managing Service Accounts

const createServiceAccount =
  yield* Grafana.CreateWorkspaceServiceAccount(workspace);

const account = yield* createServiceAccount({
  name: "dashboard-automation",
  grafanaRole: "EDITOR",
});
// account.id → the service account id used for token operations

CreateWorkspaceServiceAccountToken

Source: src/AWS/Grafana/CreateWorkspaceServiceAccountToken.ts

Runtime binding for the CreateWorkspaceServiceAccountToken operation (IAM action grafana:CreateWorkspaceServiceAccountToken), scoped to one Workspace.

Mints a short-lived API token for a Grafana service account. The token key is returned exactly once, as a Redacted value — use it as a Bearer token against the workspace’s Grafana HTTP API. Ideal for token rotation from a scheduled Lambda. Provide the implementation with Effect.provide(AWS.Grafana.CreateWorkspaceServiceAccountTokenHttp).

CreateWorkspaceServiceAccountToken: Managing Service Accounts

const createToken =
  yield* Grafana.CreateWorkspaceServiceAccountToken(workspace);

const { serviceAccountToken } = yield* createToken({
  name: "rotation-2026-07",
  serviceAccountId: account.id,
  timeToLive: "1 hour",
});
const key = Redacted.value(serviceAccountToken.key); // "glsa_..."

DeleteWorkspaceServiceAccount

Source: src/AWS/Grafana/DeleteWorkspaceServiceAccount.ts

Runtime binding for the DeleteWorkspaceServiceAccount operation (IAM action grafana:DeleteWorkspaceServiceAccount), scoped to one Workspace.

Deletes a Grafana service account from the workspace. Any API tokens minted for the account stop working immediately. Provide the implementation with Effect.provide(AWS.Grafana.DeleteWorkspaceServiceAccountHttp).

DeleteWorkspaceServiceAccount: Managing Service Accounts

const deleteServiceAccount =
  yield* Grafana.DeleteWorkspaceServiceAccount(workspace);

yield* deleteServiceAccount({ serviceAccountId: account.id });

DeleteWorkspaceServiceAccountToken

Source: src/AWS/Grafana/DeleteWorkspaceServiceAccountToken.ts

Runtime binding for the DeleteWorkspaceServiceAccountToken operation (IAM action grafana:DeleteWorkspaceServiceAccountToken), scoped to one Workspace.

Revokes a service account API token — the other half of a token-rotation loop. Provide the implementation with Effect.provide(AWS.Grafana.DeleteWorkspaceServiceAccountTokenHttp).

DeleteWorkspaceServiceAccountToken: Managing Service Accounts

const deleteToken =
  yield* Grafana.DeleteWorkspaceServiceAccountToken(workspace);

yield* deleteToken({
  serviceAccountId: account.id,
  tokenId: staleToken.id,
});

DescribeWorkspaceAuthentication

Source: src/AWS/Grafana/DescribeWorkspaceAuthentication.ts

Runtime binding for the DescribeWorkspaceAuthentication operation (IAM action grafana:DescribeWorkspaceAuthentication), scoped to one Workspace.

Reads the workspace’s authentication configuration — the enabled providers (AWS_SSO, SAML) and, for SAML, the IdP metadata, assertion-attribute mapping, and role values. Provide the implementation with Effect.provide(AWS.Grafana.DescribeWorkspaceAuthenticationHttp).

DescribeWorkspaceAuthentication: Managing Authentication

const describeAuth = yield* Grafana.DescribeWorkspaceAuthentication(workspace);

const { authentication } = yield* describeAuth();
// authentication.providers → ["SAML"]
// authentication.saml?.status → "CONFIGURED" | "NOT_CONFIGURED"

DescribeWorkspaceConfiguration

Source: src/AWS/Grafana/DescribeWorkspaceConfiguration.ts

Runtime binding for the DescribeWorkspaceConfiguration operation (IAM action grafana:DescribeWorkspaceConfiguration), scoped to one Workspace.

Reads the workspace’s Grafana configuration JSON string (e.g. the unifiedAlerting feature toggle) and the running Grafana version. Provide the implementation with Effect.provide(AWS.Grafana.DescribeWorkspaceConfigurationHttp).

DescribeWorkspaceConfiguration: Managing Configuration

const describeConfig = yield* Grafana.DescribeWorkspaceConfiguration(workspace);

const { configuration, grafanaVersion } = yield* describeConfig();
const parsed = JSON.parse(configuration);

DisassociateLicense

Source: src/AWS/Grafana/DisassociateLicense.ts

Runtime binding for the DisassociateLicense operation (IAM action grafana:DisassociateLicense), scoped to one Workspace.

Removes the Grafana Enterprise license from the workspace, downgrading it back to the standard edition. Provide the implementation with Effect.provide(AWS.Grafana.DisassociateLicenseHttp).

DisassociateLicense: Managing Licenses

const disassociateLicense = yield* Grafana.DisassociateLicense(workspace);

yield* disassociateLicense({ licenseType: "ENTERPRISE" });

ListPermissions

Source: src/AWS/Grafana/ListPermissions.ts

Runtime binding for the ListPermissions operation (IAM action grafana:ListPermissions), scoped to one Workspace.

Lists the IAM Identity Center users and groups granted the ADMIN, EDITOR, or VIEWER role in the workspace, optionally filtered by user or group id. Provide the implementation with Effect.provide(AWS.Grafana.ListPermissionsHttp).

ListPermissions: Managing Permissions

const listPermissions = yield* Grafana.ListPermissions(workspace);

const { permissions } = yield* listPermissions();
for (const entry of permissions) {
  yield* Effect.logInfo(`${entry.user.id} → ${entry.role}`);
}

ListVersions

Source: src/AWS/Grafana/ListVersions.ts

Runtime binding for the ListVersions operation (IAM action grafana:ListVersions).

Lists the Grafana versions available when creating a workspace, or — with a workspaceId — the versions an existing workspace can be upgraded to. Provide the implementation with Effect.provide(AWS.Grafana.ListVersionsHttp).

ListVersions: Managing Configuration

const listVersions = yield* Grafana.ListVersions();

const { grafanaVersions } = yield* listVersions();
// grafanaVersions → ["10.4", "9.4", ...]

ListWorkspaceServiceAccounts

Source: src/AWS/Grafana/ListWorkspaceServiceAccounts.ts

Runtime binding for the ListWorkspaceServiceAccounts operation (IAM action grafana:ListWorkspaceServiceAccounts), scoped to one Workspace.

Lists the Grafana service accounts in the workspace. Provide the implementation with Effect.provide(AWS.Grafana.ListWorkspaceServiceAccountsHttp).

ListWorkspaceServiceAccounts: Managing Service Accounts

const listServiceAccounts =
  yield* Grafana.ListWorkspaceServiceAccounts(workspace);

const { serviceAccounts } = yield* listServiceAccounts();
for (const account of serviceAccounts) {
  yield* Effect.logInfo(`${account.name} (${account.grafanaRole})`);
}

ListWorkspaceServiceAccountTokens

Source: src/AWS/Grafana/ListWorkspaceServiceAccountTokens.ts

Runtime binding for the ListWorkspaceServiceAccountTokens operation (IAM action grafana:ListWorkspaceServiceAccountTokens), scoped to one Workspace.

Lists the API tokens of a Grafana service account (metadata only — the secret key is only returned at mint time). Provide the implementation with Effect.provide(AWS.Grafana.ListWorkspaceServiceAccountTokensHttp).

ListWorkspaceServiceAccountTokens: Managing Service Accounts

const listTokens =
  yield* Grafana.ListWorkspaceServiceAccountTokens(workspace);

const { serviceAccountTokens } = yield* listTokens({
  serviceAccountId: account.id,
});
const expired = serviceAccountTokens.filter(
  (token) => token.expiresAt.getTime() < Date.now(),
);

UpdatePermissions

Source: src/AWS/Grafana/UpdatePermissions.ts

Runtime binding for the UpdatePermissions operation (IAM action grafana:UpdatePermissions), scoped to one Workspace.

Grants or revokes the ADMIN, EDITOR, or VIEWER role for IAM Identity Center users and groups in the workspace. Rejected instructions come back in the response’s errors list rather than failing the call. Provide the implementation with Effect.provide(AWS.Grafana.UpdatePermissionsHttp).

UpdatePermissions: Managing Permissions

const updatePermissions = yield* Grafana.UpdatePermissions(workspace);

const { errors } = yield* updatePermissions({
  updateInstructionBatch: [
    {
      action: "ADD",
      role: "EDITOR",
      users: [{ id: userId, type: "SSO_USER" }],
    },
  ],
});
// errors → [] when every instruction applied

UpdateWorkspaceAuthentication

Source: src/AWS/Grafana/UpdateWorkspaceAuthentication.ts

Runtime binding for the UpdateWorkspaceAuthentication operation (IAM action grafana:UpdateWorkspaceAuthentication), scoped to one Workspace.

Defines the SAML identity provider the workspace authenticates users from — IdP metadata, assertion-attribute mapping, and which groups receive the Admin and Editor roles. Changes can take a few minutes to apply. Provide the implementation with Effect.provide(AWS.Grafana.UpdateWorkspaceAuthenticationHttp).

UpdateWorkspaceAuthentication: Managing Authentication

const updateAuth = yield* Grafana.UpdateWorkspaceAuthentication(workspace);

yield* updateAuth({
  authenticationProviders: ["SAML"],
  samlConfiguration: {
    idpMetadata: { url: "https://idp.example.com/metadata.xml" },
    assertionAttributes: { role: "grafanaRole" },
    roleValues: { admin: ["platform-team"] },
  },
});

UpdateWorkspaceConfiguration

Source: src/AWS/Grafana/UpdateWorkspaceConfiguration.ts

Runtime binding for the UpdateWorkspaceConfiguration operation (IAM action grafana:UpdateWorkspaceConfiguration), scoped to one Workspace.

Writes the workspace’s Grafana configuration JSON string and can also trigger an in-place Grafana version upgrade via grafanaVersion. Provide the implementation with Effect.provide(AWS.Grafana.UpdateWorkspaceConfigurationHttp).

UpdateWorkspaceConfiguration: Managing Configuration

const updateConfig = yield* Grafana.UpdateWorkspaceConfiguration(workspace);

yield* updateConfig({
  configuration: JSON.stringify({
    unifiedAlerting: { enabled: true },
  }),
});

Workspace

Source: src/AWS/Grafana/Workspace.ts

An Amazon Managed Grafana workspace — a fully-managed Grafana server for visualizing operational metrics, logs, and traces.

Grafana workspaces require IAM Identity Center (AWS SSO) to be enabled in the account when authenticationProviders includes AWS_SSO. Workspace provisioning is asynchronous and can take a few minutes.

Workspace: Creating a Workspace

const workspace = yield* Grafana.Workspace("Dashboards", {
  accountAccessType: "CURRENT_ACCOUNT",
  authenticationProviders: ["AWS_SSO"],
  permissionType: "SERVICE_MANAGED",
  dataSources: ["PROMETHEUS", "CLOUDWATCH"],
});