workspaces

Creates, updates, deletes or gets a workspace resource or lists workspaces in a region

Overview

Name	workspaces
Type	Resource
Description	Definition of AWS::Grafana::Workspace Resource Type
Id	awscc.grafana.workspaces

Fields

get (all properties)

Name	Datatype	Description
authentication_providers	array	List of authentication providers to enable.
sso_client_id	string	The client ID of the AWS SSO Managed Application.
▶saml_configuration	object	SAML configuration data associated with an AMG workspace.
▶network_access_control	object	The configuration settings for Network Access Control.
▶vpc_configuration	object	The configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to.
saml_configuration_status	string	Valid SAML configuration statuses.
client_token	string	A unique, case-sensitive, user-provided identifier to ensure the idempotency of the request.
status	string	These enums represent the status of a workspace.
creation_timestamp	string	Timestamp when the workspace was created.
modification_timestamp	string	Timestamp when the workspace was last modified
grafana_version	string	The version of Grafana to support in your workspace.
endpoint	string	Endpoint for the Grafana workspace.
account_access_type	string	These enums represent valid account access types. Specifically these enums determine whether the workspace can access AWS resources in the AWS account only, or whether it can also access resources in other accounts in the same organization. If the value CURRENT_ACCOUNT is used, a workspace role ARN must be provided. If the value is ORGANIZATION, a list of organizational units must be provided.
organization_role_name	string	The name of an IAM role that already exists to use with AWS Organizations to access AWS data sources and notification channels in other accounts in an organization.
permission_type	string	These enums represent valid permission types to use when creating or configuring a Grafana workspace. The SERVICE_MANAGED permission type means the Managed Grafana service will create a workspace IAM role on your behalf. The CUSTOMER_MANAGED permission type means that the customer is expected to provide an IAM role that the Grafana workspace can use to query data sources.
stack_set_name	string	The name of the AWS CloudFormation stack set to use to generate IAM roles to be used for this workspace.
data_sources	array	List of data sources on the service managed IAM role.
description	string	Description of a workspace.
id	string	The id that uniquely identifies a Grafana workspace.
name	string	The user friendly name of a workspace.
notification_destinations	array	List of notification destinations on the customers service managed IAM role that the Grafana workspace can query.
organizational_units	array	List of Organizational Units containing AWS accounts the Grafana workspace can pull data from.
role_arn	string	IAM Role that will be used to grant the Grafana workspace access to a customers AWS resources.
plugin_admin_enabled	boolean	Allow workspace admins to install plugins
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
id	string	The id that uniquely identifies a Grafana workspace.
region	string	AWS region.

For more information, see AWS::Grafana::Workspace.

Methods

Name	Resource	Accessible by	Required Params
create_resource	workspaces	INSERT	AuthenticationProviders, PermissionType, AccountAccessType, region
delete_resource	workspaces	DELETE	Identifier, region
update_resource	workspaces	UPDATE	Identifier, PatchDocument, region
list_resources	workspaces_list_only	SELECT	region
get_resource	workspaces	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual workspace.

SELECT
  region,
  authentication_providers,
  sso_client_id,
  saml_configuration,
  network_access_control,
  vpc_configuration,
  saml_configuration_status,
  client_token,
  status,
  creation_timestamp,
  modification_timestamp,
  grafana_version,
  endpoint,
  account_access_type,
  organization_role_name,
  permission_type,
  stack_set_name,
  data_sources,
  description,
  id,
  name,
  notification_destinations,
  organizational_units,
  role_arn,
  plugin_admin_enabled
FROM awscc.grafana.workspaces
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ id }}';

list (identifiers only)

Lists all workspaces in a region.

SELECT
  region,
  id
FROM awscc.grafana.workspaces_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new workspace resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.grafana.workspaces (
  AuthenticationProviders,
  AccountAccessType,
  PermissionType,
  region
)
SELECT
  '{{ authentication_providers }}',
  '{{ account_access_type }}',
  '{{ permission_type }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.grafana.workspaces (
  AuthenticationProviders,
  SamlConfiguration,
  NetworkAccessControl,
  VpcConfiguration,
  ClientToken,
  GrafanaVersion,
  AccountAccessType,
  OrganizationRoleName,
  PermissionType,
  StackSetName,
  DataSources,
  Description,
  Name,
  NotificationDestinations,
  OrganizationalUnits,
  RoleArn,
  PluginAdminEnabled,
  region
)
SELECT
  '{{ authentication_providers }}',
  '{{ saml_configuration }}',
  '{{ network_access_control }}',
  '{{ vpc_configuration }}',
  '{{ client_token }}',
  '{{ grafana_version }}',
  '{{ account_access_type }}',
  '{{ organization_role_name }}',
  '{{ permission_type }}',
  '{{ stack_set_name }}',
  '{{ data_sources }}',
  '{{ description }}',
  '{{ name }}',
  '{{ notification_destinations }}',
  '{{ organizational_units }}',
  '{{ role_arn }}',
  '{{ plugin_admin_enabled }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: workspace
    props:
      - name: authentication_providers
        value:
          - '{{ authentication_providers[0] }}'
      - name: saml_configuration
        value:
          idp_metadata:
            url: '{{ url }}'
            xml: '{{ xml }}'
          assertion_attributes:
            name: '{{ name }}'
            login: '{{ login }}'
            email: '{{ email }}'
            groups: '{{ groups }}'
            role: '{{ role }}'
            org: '{{ org }}'
          role_values:
            editor:
              - '{{ editor[0] }}'
            admin:
              - '{{ admin[0] }}'
          allowed_organizations:
            - '{{ allowed_organizations[0] }}'
          login_validity_duration: null
      - name: network_access_control
        value:
          prefix_list_ids:
            - '{{ prefix_list_ids[0] }}'
          vpce_ids:
            - '{{ vpce_ids[0] }}'
      - name: vpc_configuration
        value:
          security_group_ids:
            - '{{ security_group_ids[0] }}'
          subnet_ids:
            - '{{ subnet_ids[0] }}'
      - name: client_token
        value: '{{ client_token }}'
      - name: grafana_version
        value: '{{ grafana_version }}'
      - name: account_access_type
        value: '{{ account_access_type }}'
      - name: organization_role_name
        value: '{{ organization_role_name }}'
      - name: permission_type
        value: '{{ permission_type }}'
      - name: stack_set_name
        value: '{{ stack_set_name }}'
      - name: data_sources
        value:
          - '{{ data_sources[0] }}'
      - name: description
        value: '{{ description }}'
      - name: name
        value: '{{ name }}'
      - name: notification_destinations
        value:
          - '{{ notification_destinations[0] }}'
      - name: organizational_units
        value:
          - '{{ organizational_units[0] }}'
      - name: role_arn
        value: '{{ role_arn }}'
      - name: plugin_admin_enabled
        value: '{{ plugin_admin_enabled }}'

UPDATE example

Use the following StackQL query and manifest file to update a workspace resource, using stack-deploy.

/*+ update */
UPDATE awscc.grafana.workspaces
SET PatchDocument = string('{{ {
    "AuthenticationProviders": authentication_providers,
    "SamlConfiguration": saml_configuration,
    "NetworkAccessControl": network_access_control,
    "VpcConfiguration": vpc_configuration,
    "GrafanaVersion": grafana_version,
    "AccountAccessType": account_access_type,
    "OrganizationRoleName": organization_role_name,
    "PermissionType": permission_type,
    "StackSetName": stack_set_name,
    "DataSources": data_sources,
    "Description": description,
    "Name": name,
    "NotificationDestinations": notification_destinations,
    "OrganizationalUnits": organizational_units,
    "RoleArn": role_arn,
    "PluginAdminEnabled": plugin_admin_enabled
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ id }}';

DELETE example

/*+ delete */
DELETE FROM awscc.grafana.workspaces
WHERE
  Identifier = '{{ id }}' AND
  region = 'us-east-1';

Permissions

To operate on the workspaces resource, the following permissions are required:

Create

grafana:CreateWorkspace,
grafana:DescribeWorkspace,
grafana:DescribeWorkspaceAuthentication,
grafana:DescribeWorkspaceConfiguration,
grafana:UpdateWorkspaceAuthentication,
sso:DescribeRegisteredRegions,
sso:CreateManagedApplicationInstance,
organizations:DescribeOrganization,
sso:GetSharedSsoConfiguration,
iam:PassRole,
ec2:GetManagedPrefixListEntries,
ec2:DescribeSecurityGroups,
ec2:DescribeSubnets,
ec2:DescribeVpcs,
iam:CreateServiceLinkedRole,
sso:ListApplicationInstances,
sso:GetApplicationInstance

Read

grafana:DescribeWorkspace,
grafana:DescribeWorkspaceAuthentication,
grafana:DescribeWorkspaceConfiguration

Update

grafana:DescribeWorkspace,
grafana:DescribeWorkspaceAuthentication,
grafana:DescribeWorkspaceConfiguration,
grafana:UpdateWorkspace,
grafana:UpdateWorkspaceAuthentication,
grafana:UpdateWorkspaceConfiguration,
sso:DescribeRegisteredRegions,
sso:CreateManagedApplicationInstance,
ec2:GetManagedPrefixListEntries,
iam:PassRole,
ec2:DescribeSecurityGroups,
ec2:DescribeSubnets,
ec2:DescribeVpcs,
iam:CreateServiceLinkedRole,
sso:ListApplicationInstances,
sso:GetApplicationInstance

Delete

grafana:DeleteWorkspace,
grafana:DescribeWorkspace,
grafana:DescribeWorkspaceAuthentication,
grafana:DescribeWorkspaceConfiguration,
sso:DeleteManagedApplicationInstance,
sso:DescribeRegisteredRegions

List

grafana:ListWorkspaces,
grafana:DescribeWorkspaceAuthentication,
grafana:DescribeWorkspaceConfiguration