Merge pull request #163 from aws-observability/mg-v10

Update docs for Service accounts and Grafana v10
aws-observability · May 16, 2024 · cb5c451 · cb5c451
2 parents 86a09eb + 0fbd761
commit cb5c451
Show file tree

Hide file tree

Showing 8 changed files with 336 additions and 105 deletions.
diff --git a/...observability-accelerators/existing-eks-adotmetrics-collection-observability.md b/...observability-accelerators/existing-eks-adotmetrics-collection-observability.md
@@ -54,17 +54,40 @@ export COA_AMG_ENDPOINT_URL=https://g-xyz.grafana-workspace.us-east-1.amazonaws.
 !!! warning
 Setting up environment variables `COA_AMG_ENDPOINT_URL` and `AWS_REGION` is mandatory for successful execution of this pattern.
 
-4. GRAFANA API KEY: Amazon Managed Grafana provides a control plane API for generating Grafana API keys.
-
-```bash
-export AMG_API_KEY=$(aws grafana create-workspace-api-key \
-  --key-name "grafana-operator-key" \
-  --key-role "ADMIN" \
-  --seconds-to-live 432000 \
-  --workspace-id $COA_AMG_WORKSPACE_ID \
-  --query key \
-  --output text)
-```
+4. GRAFANA API KEY: Amazon Managed Grafana provides a control plane API for generating Grafana API keys or Service Account Tokens.
+
+=== "v10.4 & v9.4 workspaces"
+
+    ```bash
+    # IMPORTANT NOTE: skip this command if you already have a service token
+    GRAFANA_SA_ID=$(aws grafana create-workspace-service-account \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --grafana-role ADMIN \
+      --name cdk-accelerator-eks \
+      --query 'id' \
+      --output text)
+
+    # creates a new token
+    export AMG_API_KEY=$(aws grafana create-workspace-service-account-token \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      -name "grafana-operator-key" \
+      --seconds-to-live 432000 \
+      --service-account-id $GRAFANA_SA_ID \
+      --query 'serviceAccountToken.key' \
+      --output text)
+    ```
+
+=== "v8.4 workspaces"
+
+    ```bash
+    export AMG_API_KEY=$(aws grafana create-workspace-api-key \
+      --key-name "grafana-operator-key" \
+      --key-role "ADMIN" \
+      --seconds-to-live 432000 \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --query key \
+      --output text)
+    ```
 
 5. AWS SSM Parameter Store for GRAFANA API KEY: Update the Grafana API key secret in AWS SSM Parameter Store using the above new Grafana API key. This will be referenced by Grafana Operator deployment of our solution to access Amazon Managed Grafana from Amazon EKS Cluster
 

diff --git a/...existing-eks-observability-accelerators/existing-eks-apiserver-observability.md b/...existing-eks-observability-accelerators/existing-eks-apiserver-observability.md
@@ -65,17 +65,40 @@ export COA_AMG_ENDPOINT_URL=https://g-xyz.grafana-workspace.us-east-1.amazonaws.
 !!! warning
 Setting up environment variables `COA_AMG_ENDPOINT_URL` and `AWS_REGION` is mandatory for successful execution of this pattern.
 
-4. GRAFANA API KEY: Amazon Managed Grafana provides a control plane API for generating Grafana API keys.
-
-```bash
-export AMG_API_KEY=$(aws grafana create-workspace-api-key \
-  --key-name "grafana-operator-key" \
-  --key-role "ADMIN" \
-  --seconds-to-live 432000 \
-  --workspace-id $COA_AMG_WORKSPACE_ID \
-  --query key \
-  --output text)
-```
+4. GRAFANA API KEY: Amazon Managed Grafana provides a control plane API for generating Grafana API keys or Service Account Tokens.
+
+=== "v10.4 & v9.4 workspaces"
+
+    ```bash
+    # IMPORTANT NOTE: skip this command if you already have a service token
+    GRAFANA_SA_ID=$(aws grafana create-workspace-service-account \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --grafana-role ADMIN \
+      --name cdk-accelerator-eks \
+      --query 'id' \
+      --output text)
+
+    # creates a new token
+    export AMG_API_KEY=$(aws grafana create-workspace-service-account-token \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      -name "grafana-operator-key" \
+      --seconds-to-live 432000 \
+      --service-account-id $GRAFANA_SA_ID \
+      --query 'serviceAccountToken.key' \
+      --output text)
+    ```
+
+=== "v8.4 workspaces"
+
+    ```bash
+    export AMG_API_KEY=$(aws grafana create-workspace-api-key \
+      --key-name "grafana-operator-key" \
+      --key-role "ADMIN" \
+      --seconds-to-live 432000 \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --query key \
+      --output text)
+    ```
 
 5. AWS SSM Parameter Store for GRAFANA API KEY: Update the Grafana API key secret in AWS SSM Parameter Store using the above new Grafana API key. This will be referenced by Grafana Operator deployment of our solution to access Amazon Managed Grafana from Amazon EKS Cluster
 

diff --git a/...rns/existing-eks-observability-accelerators/existing-eks-nginx-observability.md b/...rns/existing-eks-observability-accelerators/existing-eks-nginx-observability.md
@@ -72,17 +72,40 @@ export COA_AMG_ENDPOINT_URL=https://g-xyz.grafana-workspace.us-east-1.amazonaws.
 !!! warning
 Setting up environment variables `COA_AMG_ENDPOINT_URL` and `AWS_REGION` is mandatory for successful execution of this pattern.
 
-4. GRAFANA API KEY: Amazon Managed Grafana provides a control plane API for generating Grafana API keys.
-
-```bash
-export AMG_API_KEY=$(aws grafana create-workspace-api-key \
-  --key-name "grafana-operator-key" \
-  --key-role "ADMIN" \
-  --seconds-to-live 432000 \
-  --workspace-id $COA_AMG_WORKSPACE_ID \
-  --query key \
-  --output text)
-```
+4. GRAFANA API KEY: Amazon Managed Grafana provides a control plane API for generating Grafana API keys or Service Account Tokens.
+
+=== "v10.4 & v9.4 workspaces"
+
+    ```bash
+    # IMPORTANT NOTE: skip this command if you already have a service token
+    GRAFANA_SA_ID=$(aws grafana create-workspace-service-account \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --grafana-role ADMIN \
+      --name cdk-accelerator-eks \
+      --query 'id' \
+      --output text)
+
+    # creates a new token
+    export AMG_API_KEY=$(aws grafana create-workspace-service-account-token \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      -name "grafana-operator-key" \
+      --seconds-to-live 432000 \
+      --service-account-id $GRAFANA_SA_ID \
+      --query 'serviceAccountToken.key' \
+      --output text)
+    ```
+
+=== "v8.4 workspaces"
+
+    ```bash
+    export AMG_API_KEY=$(aws grafana create-workspace-api-key \
+      --key-name "grafana-operator-key" \
+      --key-role "ADMIN" \
+      --seconds-to-live 432000 \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --query key \
+      --output text)
+    ```
 
 5. AWS SSM Parameter Store for GRAFANA API KEY: Update the Grafana API key secret in AWS SSM Parameter Store using the above new Grafana API key. This will be referenced by Grafana Operator deployment of our solution to access Amazon Managed Grafana from Amazon EKS Cluster
 

diff --git a/...xisting-eks-observability-accelerators/existing-eks-opensource-observability.md b/...xisting-eks-observability-accelerators/existing-eks-opensource-observability.md
@@ -80,17 +80,40 @@ export COA_AMG_ENDPOINT_URL=https://g-xyz.grafana-workspace.us-east-1.amazonaws.
 !!! warning
 Setting up environment variables `COA_AMG_ENDPOINT_URL` and `AWS_REGION` is mandatory for successful execution of this pattern.
 
-4. GRAFANA API KEY: Amazon Managed Grafana provides a control plane API for generating Grafana API keys.
-
-```bash
-export AMG_API_KEY=$(aws grafana create-workspace-api-key \
-  --key-name "grafana-operator-key" \
-  --key-role "ADMIN" \
-  --seconds-to-live 432000 \
-  --workspace-id $COA_AMG_WORKSPACE_ID \
-  --query key \
-  --output text)
-```
+4. GRAFANA API KEY: Amazon Managed Grafana provides a control plane API for generating Grafana API keys or Service Account Tokens.
+
+=== "v10.4 & v9.4 workspaces"
+
+    ```bash
+    # IMPORTANT NOTE: skip this command if you already have a service token
+    GRAFANA_SA_ID=$(aws grafana create-workspace-service-account \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --grafana-role ADMIN \
+      --name cdk-accelerator-eks \
+      --query 'id' \
+      --output text)
+
+    # creates a new token
+    export AMG_API_KEY=$(aws grafana create-workspace-service-account-token \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      -name "grafana-operator-key" \
+      --seconds-to-live 432000 \
+      --service-account-id $GRAFANA_SA_ID \
+      --query 'serviceAccountToken.key' \
+      --output text)
+    ```
+
+=== "v8.4 workspaces"
+
+    ```bash
+    export AMG_API_KEY=$(aws grafana create-workspace-api-key \
+      --key-name "grafana-operator-key" \
+      --key-role "ADMIN" \
+      --seconds-to-live 432000 \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --query key \
+      --output text)
+    ```
 
 5. AWS SSM Parameter Store for GRAFANA API KEY: Update the Grafana API key secret in AWS SSM Parameter Store using the above new Grafana API key. This will be referenced by Grafana Operator deployment of our solution to access Amazon Managed Grafana from Amazon EKS Cluster
 

diff --git a/...w-eks-observability-accelerators/single-new-eks-gpu-opensource-observability.md b/...w-eks-observability-accelerators/single-new-eks-gpu-opensource-observability.md
@@ -64,17 +64,40 @@ export COA_AMG_ENDPOINT_URL=https://g-xyz.grafana-workspace.us-east-1.amazonaws.
 !!! warning
     Setting up environment variables `COA_AMG_ENDPOINT_URL` and `AWS_REGION` is mandatory for successful execution of this pattern.
 
-4. GRAFANA API KEY: Amazon Managed Grafana provides a control plane API for generating Grafana API keys.
-
-```bash
-export AMG_API_KEY=$(aws grafana create-workspace-api-key \
-  --key-name "grafana-operator-key" \
-  --key-role "ADMIN" \
-  --seconds-to-live 432000 \
-  --workspace-id $COA_AMG_WORKSPACE_ID \
-  --query key \
-  --output text)
-```
+4. GRAFANA API KEY: Amazon Managed Grafana provides a control plane API for generating Grafana API keys or Service Account Tokens.
+
+=== "v10.4 & v9.4 workspaces"
+
+    ```bash
+    # IMPORTANT NOTE: skip this command if you already have a service token
+    GRAFANA_SA_ID=$(aws grafana create-workspace-service-account \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --grafana-role ADMIN \
+      --name cdk-accelerator-eks \
+      --query 'id' \
+      --output text)
+
+    # creates a new token
+    export AMG_API_KEY=$(aws grafana create-workspace-service-account-token \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      -name "grafana-operator-key" \
+      --seconds-to-live 432000 \
+      --service-account-id $GRAFANA_SA_ID \
+      --query 'serviceAccountToken.key' \
+      --output text)
+    ```
+
+=== "v8.4 workspaces"
+
+    ```bash
+    export AMG_API_KEY=$(aws grafana create-workspace-api-key \
+      --key-name "grafana-operator-key" \
+      --key-role "ADMIN" \
+      --seconds-to-live 432000 \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --query key \
+      --output text)
+    ```
 
 5. AWS SSM Parameter Store for GRAFANA API KEY: Update the Grafana API key secret in AWS SSM Parameter Store using the above new Grafana API key. This will be referenced by Grafana Operator deployment of our solution to access Amazon Managed Grafana from Amazon EKS Cluster
 

diff --git a/...-observability-accelerators/single-new-eks-graviton-opensource-observability.md b/...-observability-accelerators/single-new-eks-graviton-opensource-observability.md
@@ -67,17 +67,40 @@ export COA_AMG_ENDPOINT_URL=https://g-xyz.grafana-workspace.us-east-1.amazonaws.
 !!! warning
     Setting up environment variables `COA_AMG_ENDPOINT_URL` and `AWS_REGION` is mandatory for successful execution of this pattern.
 
-4. GRAFANA API KEY: Amazon Managed Grafana provides a control plane API for generating Grafana API keys.
-
-```bash
-export AMG_API_KEY=$(aws grafana create-workspace-api-key \
-  --key-name "grafana-operator-key" \
-  --key-role "ADMIN" \
-  --seconds-to-live 432000 \
-  --workspace-id $COA_AMG_WORKSPACE_ID \
-  --query key \
-  --output text)
-```
+4. GRAFANA API KEY: Amazon Managed Grafana provides a control plane API for generating Grafana API keys or Service Account Tokens.
+
+=== "v10.4 & v9.4 workspaces"
+
+    ```bash
+    # IMPORTANT NOTE: skip this command if you already have a service token
+    GRAFANA_SA_ID=$(aws grafana create-workspace-service-account \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --grafana-role ADMIN \
+      --name cdk-accelerator-eks \
+      --query 'id' \
+      --output text)
+
+    # creates a new token
+    export AMG_API_KEY=$(aws grafana create-workspace-service-account-token \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      -name "grafana-operator-key" \
+      --seconds-to-live 432000 \
+      --service-account-id $GRAFANA_SA_ID \
+      --query 'serviceAccountToken.key' \
+      --output text)
+    ```
+
+=== "v8.4 workspaces"
+
+    ```bash
+    export AMG_API_KEY=$(aws grafana create-workspace-api-key \
+      --key-name "grafana-operator-key" \
+      --key-role "ADMIN" \
+      --seconds-to-live 432000 \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --query key \
+      --output text)
+    ```
 
 5. AWS Secrets Manager for GRAFANA API KEY: Update the Grafana API key secret in AWS Secrets using the above new Grafana API key. This will be referenced by Grafana Operator deployment of our solution to access Amazon Managed Grafana from Amazon EKS Cluster
 
@@ -375,15 +398,38 @@ If you observe, the the above `grafana-api-key error` in the logs, your grafana
 
 - First, lets create a new Grafana API key.
 
-```bash
-export GO_AMG_API_KEY=$(aws grafana create-workspace-api-key \
-  --key-name "grafana-operator-key-new" \
-  --key-role "ADMIN" \
-  --seconds-to-live 432000 \
-  --workspace-id $COA_AMG_WORKSPACE_ID \
-  --query key \
-  --output text)
-```
+=== "v10.4 & v9.4 workspaces"
+
+    ```bash
+    # IMPORTANT NOTE: skip this command if you already have a service token
+    GRAFANA_SA_ID=$(aws grafana create-workspace-service-account \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --grafana-role ADMIN \
+      --name cdk-accelerator-eks \
+      --query 'id' \
+      --output text)
+
+    # creates a new token
+    export GO_AMG_API_KEY=$(aws grafana create-workspace-service-account-token \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      -name "grafana-operator-key" \
+      --seconds-to-live 432000 \
+      --service-account-id $GRAFANA_SA_ID \
+      --query 'serviceAccountToken.key' \
+      --output text)
+    ```
+
+=== "v8.4 workspaces"
+
+    ```bash
+    export GO_AMG_API_KEY=$(aws grafana create-workspace-api-key \
+      --key-name "grafana-operator-key" \
+      --key-role "ADMIN" \
+      --seconds-to-live 432000 \
+      --workspace-id $COA_AMG_WORKSPACE_ID \
+      --query key \
+      --output text)
+    ```
 
 - Finally, update the Grafana API key secret in AWS Secrets Manager using the above new Grafana API key: