From 3c8b7704f66c618644a8544e9962bd29952388b4 Mon Sep 17 00:00:00 2001
From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
Date: Thu, 28 May 2026 18:59:09 -0400
Subject: [PATCH] Fix Grafana Athena auth: use default credential chain, not
 ec2_iam_role
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Grafana rejected the datasource with 'trying to use non-allowed auth method
ec2_iam_role: Failed to create client' — the plugin's allowed_auth_providers
defaults to default,keys,credentials and excludes ec2_iam_role. Switch authType
to 'default' (AWS SDK default chain), which on EC2 resolves to the instance role
via IMDS (still no static keys) and is allowed out of the box.
---
 grafana/provisioning/datasources/athena.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/grafana/provisioning/datasources/athena.yaml b/grafana/provisioning/datasources/athena.yaml
index 58072bf..bd955d9 100644
--- a/grafana/provisioning/datasources/athena.yaml
+++ b/grafana/provisioning/datasources/athena.yaml
@@ -1,5 +1,8 @@
 # Athena datasource, authenticated via the EC2 instance IAM role (no static keys).
 # Provisioned into /etc/grafana/provisioning/datasources/ via user-data (Phase 5).
+# authType "default" = AWS SDK default credential chain, which on EC2 resolves to
+# the instance role via IMDS. ("ec2_iam_role" is rejected by the plugin unless
+# added to [aws] allowed_auth_providers; "default" is allowed out of the box.)
 apiVersion: 1
 datasources:
   - name: Athena
@@ -7,7 +10,7 @@ datasources:
     uid: athena
     isDefault: true
     jsonData:
-      authType: ec2_iam_role
+      authType: default
       defaultRegion: us-east-1
       catalog: AwsDataCatalog
       database: apm_wo_analysis