AWS Grafana/CloudWatch - How to show Bill by accountId

Question

I am trying to create a dashboard for billing under our AWS. Our AWS set up is as such:

masterAccount //access to all sub AWS account's billing info
  subAccount1
  subAccount2 //this is where Grafana is running

I have the data source from the masterAccount, which is a cloudwatchReadOnly access and have set it up the the assumeRole works from subAccount2, where Grafana is running.

I get the data as below (sensitive data, so had to cover it out):

However, what I am looking for is to grab the billing data from this data source but then, split it by the AWS accountId.

I don't know how to go about this at all. Very new to Grafana. Thanks in advance!

Answer 1

Create Grafana CloudWatch datasource for each sub account and then make query for each sub account/datasource.

Answer 2

In the query settings you can choose LinkedAccount=* as dimension. Than the graph shows the whole list of the linked accounts of the master account.

Answer 3

As Jan Garaj said, the way to go about this is to create multiple datasources and then, use them for different widgets. Each datasource is an ARN for the role you created in the subAccounts.

The instance profile attached to the EC2 instance:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": [
                "arn:aws:iam::subAccount1:role/roleName",
                "arn:aws:iam::subAccount2:role/roleName",
                "arn:aws:iam::subAccount3:role/roleName"
            ]
        }
    ]
}

With Trust Relationship as:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Then, on the subAccounts (subAccount1 as an example)

//AWS Created Policy
CloudWatchReadOnlyAccess

//With Trust Relationship
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com",
        "AWS": "arn:aws:iam::accountWhereEC2InstanceIsRunning:role/nameOfInstanceProfile"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Hope this comes in handy for someone.