不同 aws 账户的一个角色

Question

I have below requirement for dashboard in grafana -

We have around 20 different aws accounts. I want to collect cloudwatch metrics of different services from these accounts and display them in Grafana which reside in one of the aws account. The grafana is deployed on eks. I know that I can create one role in all accounts one by one and grafana can assume that role to pull the metrics. Is there a way to create single role which will be common to all accounts to pull cloudwatch metrics and push them to centralized Grafana instead of creating role in all accounts?

Answer 1

1.) You are not pushing data to centralized Grafana. That centralized Grafana is pulling data from other accounts.

2.) It will be a huge security role if you can create single role which will allow you to read other accounts metrics without any interaction with those accounts. So that's not possible.