# How-to-integrate-Grafana-login-with-AWS-Cognito_690087085
This guide introduce how to integrate Grafana with AWS Cognito for authentication, allowing users to log in using their AWS Cognito credentials.

#### Step 1: Set Up AWS Cognito User Pool

1. Login AWS account 361684190412 and locate in Oregon region.
2. In the **AWS Console**, navigate to **Amazon Cognito**. We have created a user pool called "notes-user-pool", click this user pool and go to **App clients** and choose **esm-saas-grafana** client and click it.  
	![](attachments/690087085/690087974.png)
3. Take note of the App client ID and App client secret which will be used in the following steps.  
	![](attachments/690087085/690087978.png)
4. Still under this app client, go to **Login pages** and click **Edit**, add the farm's callback url [https://<grafana-domain>/grafana/login/generic\_oauth](https://us2-testing-monitoring.itsma-ng.com/grafana/login/generic_oauth),eg:[https://us2-testing-monitoring.itsma-ng.com/grafana/login/generic\_oauth](https://us2-testing-monitoring.itsma-ng.com/grafana/login/generic_oauth) to the **Allowed callback URLs** like below.  
	![](attachments/690087085/690088004.png) ![](attachments/690087085/690087992.png)

#### Step 2: Configure Grafana

1. Backup the itom-prometheus-grafana configmap firstly.

```
kubectl get cm itom-prometheus-grafana -n monitoring -o yaml > /tmp/itom-prometheus-grafana_cm_bak.yaml
```

2\. Edit the itom-prometheus-grafana configmap and add \[auth.generic\_oauth\] section at the end of data.grafana.ini like below, configure the settings for AWS Cognito authentication.

```
kubectl edit cm itom-prometheus-grafana -n monitoring
```

```
[auth.generic_oauth]
enabled = true
name = AWS Cognito
client_id = <replace with Client ID which get from setp1.3>
client_secret = <replace with client secret which get from step1.3>
scopes = openid email
auth_url = https://saas-ops-jenkins.auth.us-west-2.amazoncognito.com/oauth2/authorize
token_url = https://saas-ops-jenkins.auth.us-west-2.amazoncognito.com/oauth2/token
api_url = https://saas-ops-jenkins.auth.us-west-2.amazoncognito.com/oauth2/userInfo
```

eg:

![](attachments/690087085/690087371.png)

3\. Check if the root\_url is right in the itom-prometheus-grafana configmap. The root url is the url which we use to login grafana. If not right, also need to update it.

![](attachments/690087085/690087381.png)

4\. Still in itom-prometheus-grafana configmap, check if we have configued with anonymous enabled. If yes, we need to **remove** these two lines to disable it.

![](attachments/690087085/690088046.png)

5\. Rolling restart grafana pod and wait for the new pod running up.

```
kubectl rollout restart deploy itom-prometheus-grafana -n monitoring
```

#### Step 3: Verification

Try to login with Grafana using your cognito account. If login is successful, the congiuration is fine.  
![](attachments/690087085/690087388.png)

**\[Optional\] Assign Admin Role to your cognito account**

If you need Admin Role for you Cognito account,logged in grafana with super admin user. You can retrieve the user name and password from parameter store ( /<farm-name>/grafana/admin/name) & /<farm-name>/grafana/admin/password).

Go to ![](attachments/690087085/690091405.png) and click users. Chane the Role from 'Viewer' to 'Admin' for your account.

![](attachments/690087085/690091406.png)

## Attachments:

[image-2025-2-20\_11-50-0.png](attachments/690087085/690087079.png) (image/png)  
[image-2025-2-20\_13-17-42.png](attachments/690087085/690087277.png) (image/png)  
[image-2025-2-20\_13-24-19.png](attachments/690087085/690087286.png) (image/png)  
[image-2025-2-20\_13-30-16.png](attachments/690087085/690087313.png) (image/png)  
[image-2025-2-20\_13-32-43.png](attachments/690087085/690087322.png) (image/png)  
[image-2025-2-20\_13-48-24.png](attachments/690087085/690087361.png) (image/png)  
[image-2025-2-20\_13-51-37.png](attachments/690087085/690087371.png) (image/png)  
[image-2025-2-20\_13-55-35.png](attachments/690087085/690087381.png) (image/png)  
[image-2025-2-20\_13-58-32.png](attachments/690087085/690087388.png) (image/png)  
[image-2025-2-20\_14-8-6.png](attachments/690087085/690087415.png) (image/png)  
[image-2025-2-20\_16-34-19.png](attachments/690087085/690087974.png) (image/png)  
[image-2025-2-20\_16-35-23.png](attachments/690087085/690087978.png) (image/png)  
[image-2025-2-20\_16-38-12.png](attachments/690087085/690087987.png) (image/png)  
[image-2025-2-20\_16-38-59.png](attachments/690087085/690087990.png) (image/png)  
[image-2025-2-20\_16-39-27.png](attachments/690087085/690087992.png) (image/png)  
[image-2025-2-20\_16-42-3.png](attachments/690087085/690088004.png) (image/png)  
[image-2025-2-20\_16-45-2.png](attachments/690087085/690088018.png) (image/png)  
[image-2025-2-20\_16-49-11.png](attachments/690087085/690088046.png) (image/png)  
[image-2025-2-21\_11-49-45.png](attachments/690087085/690091405.png) (image/png)  
[image-2025-2-21\_11-50-54.png](attachments/690087085/690091406.png) (image/png)
