aws-observability / amazon-managed-grafana-migrator

CLI migration utility to migrate Grafana content to Amazon Managed Grafana

Amazon Managed Grafana Migrator

🎉 May-15-24: v0.2.0 supports Grafana Service Accounts for v9 and v10 workspaces. See Amazon Managed Grafana announces support for Grafana version 10.4

🚨 Jul-25-23: Alerts migration are currently disabled with v0.1.9. See #19

🎉 Jul-19-23: Amazon Grafana supports now in-place update from v8.4 to v9.4

Amazon Managed Grafana Migrator is a CLI migration utility to migrate Grafana content (data sources, dashboards, folders and alert rules) to Amazon Managed Grafana. It supports the following migration scenarios:

• Migrating from and to Amazon Managed Grafana Workspace (eg. Moving to v10.4), although consider using the native functionality in the AWS Console, after testing
• Migrating from a Grafana server to an Amazon Managed Grafana Workspace

Amazon Managed Grafana v10.4 workspaces will require to provide an ADMIN level Grafana Service Account with the --src-service-account-id or --src-service-account-id flags.

Installation

Build from latest release. This requires Go (1.21 +) installed on your environement.

go install github.com/aws-observability/amazon-managed-grafana-migrator@latest

This command above will build the binary into your Go path ($HOME/go/bin). Make sure to add your Go bin in your $PATH to run the command. For Linux, this is usually export PATH=$PATH:$HOME/go/bin.

You can also download the pre-compiled binary for your OS and CPU architecture from our GitHub releases.

Example on Amazon Linux:

wget https://github.com/aws-observability/amazon-managed-grafana-migrator/releases/download/v0.1.11/amazon-managed-grafana-migrator-linux-amd64.tar.gz
tar -zxvf amazon-managed-grafana-migrator-linux-amd64.tar.gz
sudo mv amazon-managed-grafana-migrator /usr/local/bin/
amazon-managed-grafana-migrator -v

Usage

Discovering your Workspaces

amazon-managed-grafana-migrator discover --region eu-west-1

Migrating to Amazon Managed Grafana v10

v9 and v10 introduced Grafana Service Accounts which will be required by the migrator, especially for v10. Note that Service Accounts are billed as active users

1. Creating a Service Account

 aws grafana create-workspace-service-account --workspace-id g-abcdef5678 \
    --grafana-role ADMIN \
    --name <SA_NAME_HERE>

2. Running the migration

amazon-managed-grafana-migrator migrate \
  --src-url https://grafana.example.com/
  --src-api-key API_KEY_HERE
  --dst g-abcdef5678.grafana-workspace.us-west-2.amazonaws.com
  --dst-service-account-id SERVICE_ACCOUNT_ID_HERE

Migrating between Workspaces

amazon-managed-grafana-migrator migrate \
  --src g-abcdef1234.grafana-workspace.eu-central-1.amazonaws.com \
  --dst g-abcdef5678.grafana-workspace.us-west-2.amazonaws.com

Or for v9+ workspaces:

amazon-managed-grafana-migrator migrate \
  --src g-abcdef1234.grafana-workspace.eu-central-1.amazonaws.com \
  --src-service-account-id SERVICE_ACCOUNT_ID_HERE
  --dst g-abcdef5678.grafana-workspace.us-west-2.amazonaws.com
  --dst-service-account-id SERVICE_ACCOUNT_ID_HERE

Migrating to Amazon Managed Grafana v8/v9

amazon-managed-grafana-migrator migrate \
  --src-url https://grafana.example.com/
  --src-api-key API_KEY_HERE
  --dst g-abcdef5678.grafana-workspace.us-west-2.amazonaws.com

Getting help

amazon-managed-grafana-migrator --help

# command specific help
amazon-managed-grafana-migrator migrate --help

Permissions

To run this tool you need AWS permissions through IAM. Make sure you have the AWS command line tool installed and have already run aws configure before you start. Below are the minimum permissions required by the tool:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "grafana:DescribeWorkspace",
                "grafana:CreateWorkspaceApiKey",
                "grafana:DeleteWorkspaceApiKey",
                "grafana:CreateWorkspaceServiceAccountToken",
                "grafana:DeleteWorkspaceServiceAccountToken"
            ],
            "Resource": "arn:aws:grafana:*:<ACCOUNT_ID>:/workspaces/<WORKSPACE_ID>"
        },
        {
            "Effect": "Allow",
            "Action": "grafana:ListWorkspaces",
            "Resource": "*"
        }
    ]
}

If you a migrating from a Grafana server, you will need an active API Key with "ADMIN" role.

Contributing

See CONTRIBUTING for more information.

License

This project is licensed under the Apache-2.0 License.

amazon-managed-grafana-migrator's Issues

[Question] Support for migration of Library Elements?

Please describe your question here

When attempting to use amazon-managed-grafana-migrator v0.1.11 to migrate an AWS Managed Grafana Workspace from one AWS account to another AWS account, we are getting errors relating to connecting Library panels to dashboards in the destination workspace. Although we are running this across AWS accounts, we can also reproduce this when attempting to run the command within the same AWS account.

Here is an example of the command that we are running:

amazon-managed-grafana-migrator migrate --src-url https://<redacted-A>.grafana-workspace.<redacted>.amazonaws.com --src-api-key <redacted> --dst <redacted-B>.grafana-workspace.<redacted>.amazonaws.com --verbose 

Skipping API key creation for https://<redacted-A>.grafana-workspace.<redacted>.amazonaws.com
Creating temporary API key for <redacted-B>

Migrating data sources:
Data source: account-A-source
✔ Migrated 1 data sources

Migrating folders:
Source Grafana folders found: 1
[DEBUG]  [{5 gqxpT0bSk Sites }]
Folder: Sites
[DEBUG]  &{[{5 gqxpT0bSk Sites }] [{1 gqxpT0bSk Sites /dashboards/f/gqxpT0bSk/sites}] [{1 gqxpT0bSk Sites }]}
✔ Migrated 1 folders

Migrating dashboards:
Found 3 dashboards in src
Dashboard: /d/8d1wpnhIk/dashboard-1
searching Folder ID [src folder ID/UID/Title] [5/8d1wpnhIk/Sites]  for dashboard in dst grafana: 1
	error: status: 500, body: {"message":"Error while connecting library panels","traceID":""}
Dashboard: /d/MCfVOxbIk/dashboard-2
searching Folder ID [src folder ID/UID/Title] [5/MCfVOxbIk/Sites]  for dashboard in dst grafana: 1
	error: status: 500, body: {"message":"Error while connecting library panels","traceID":""}
Dashboard: /d/G6vVCxxSz/dashboard-3
searching Folder ID [src folder ID/UID/Title] [5/G6vVCxxSz/Sites]  for dashboard in dst grafana: 1
✔ Migrated 1 dashboards

Skipping alert rules migration

Removing temporary API key for <redacted-B>

It appears that because the Library Elements are not being migrated, and 2/3 of our Dashboard elements have references to Library elements, we are seeing a 500 error occur at some point in the creation of the Dashboard Element in the destination Grafana workspace.

Is this use case supported? If it is known to not be supported, can support for this be added?

Provide link to the example related to the question

For reference, it appears that the Library Elements are simply not being migrated, based on the top level App code:

amazon-managed-grafana-migrator/internal/pkg/app/app.go

Line 34 in 994a90d

func (a *App) Run(srcCustomGrafanaClient CustomGrafanaClient) error {

For further reference, it does appear that the Library Element API is well supported on this version of Grafana: https://grafana.com/docs/grafana/v9.4/developers/http_api/library_element/

Additional context

We are using AWS Managed Grafana v9.4.

Please let me know if any further detail is needed.

More

• Yes, I have checked the repo for existing issues before raising this question

[Bug]: API key expires if migrating enough resources

Did you search for similar issues before submitting?

• Yes, I've searched similar issues on GitHub and didn't find any.

Release version

0.1.3

Is it a permission issue?

• I have a valid AWS CLI session.
• I'm using an IAM role with the necessary permissions.
• If migrating from a Grafana server, I used an active API key with ADMIN permissions.

What is your environment, configuration and the example used?

Grafana v8.4.7 -> Grafana v9.4.7

Get this error:

	warning: status: 401, body: {"message":"Expired API key"}

Additional Information

No response

[Bug]: migrating from 8.4 Grafana workspace shows confusing error message for alerts

Did you search for similar issues before submitting?

• Yes, I've searched similar issues on GitHub and didn't find any.

Release version

0.1.3 (though this was downloaded via the 0.1.4 release tag)

Is it a permission issue?

• I have a valid AWS CLI session.
• I'm using an IAM role with the necessary permissions.
• If migrating from a Grafana server, I used an active API key with ADMIN permissions.

What is your environment, configuration and the example used?

$ go version
go version go1.19.4 darwin/arm64

and this is at the end of the output from the migrate command

Migrating alerting rules:

Removing temporary API key for g-6b10aaa20e

Removing temporary API key for g-909b33678e
error: alerting API version not supported for src, minimum supported is v8.4

Additional Information

the source workspace is on version 8.4, and the destination is on version 9.4.

I expected it to fail on alerts migration, due to the requirement that the alerts migration is only supported for version 9.4, which is why I was confused by the output stating "minimum supported is v8.4", since if that's true, then I wouldn't expect to see this error message.

[Bug]: 404 Folder Not Found

Did you search for similar issues before submitting?

• Yes, I've searched similar issues on GitHub and didn't find any.

Release version

0.1.10

Is it a permission issue?

• I have a valid AWS CLI session.
• I'm using an IAM role with the necessary permissions.
• If migrating from a Grafana server, I used an active API key with ADMIN permissions.

What is your environment, configuration and the example used?

Trying to migrate Grafana 8 up to Grafana 9, and got this message for practically every dashboard migration.

All the folders migrated successfully, but only a few of the dashboards did, and it's unclear why. The majority of the dashboards failed with this message:

        warning: status: 404, body: {"message":"Folder not found","traceID":""}

I'm on MacOS, moving from Grafana 8.4 to Grafana 9.4.

Additional Information

No response

Add Support for --profile Flag to Enable AWS SSO Integration

Is your feature request related to a problem? Please describe

amazon-managed-grafana-migrator tool does not currently support the --profile flag, which is essential for utilizing AWS CLI profiles, especially for configurations involving AWS Single Sign-On (SSO)

Describe the solution you'd like

I would like the amazon-managed-grafana-migrator to support the --profile flag. This would allow users to specify which AWS profile to use directly through the command line interface, integrating seamlessly with the AWS CLI's profile management. This is particularly important for users with SSO configurations, allowing them to leverage different roles and permissions set up through AWS SSO.

Additional context

Adding this feature would simplify the workflow for users who manage multiple AWS profiles and rely on AWS SSO for security. It would enhance the usability of the tool in enterprise environments where different teams or projects may require different levels of access and credentials management. This support would align the tool more closely with other AWS services and tools that already support profile selection via the CLI

[Bug]: discover command fails when Grafana workspace is creating

Did you search for similar issues before submitting?

• Yes, I've searched similar issues on GitHub and didn't find any.

Release version

0.1.3

Is it a permission issue?

• I have a valid AWS CLI session.
• I'm using an IAM role with the necessary permissions.
• If migrating from a Grafana server, I used an active API key with ADMIN permissions.

What is your environment, configuration and the example used?

If an AMG workspace is being created, the tool has the following error:

[ec2-user@ip-172-31-0-89 ~]$ ./amazon-managed-grafana-migrator discover --region us-east-2
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x8a72e5]

goroutine 1 [running]:
github.com/aws-observability/amazon-managed-grafana-migrator/internal/pkg/aws.(*AMG).ListWorkspaces(0xc000061f80)
	/github/workspace/internal/pkg/aws/aws.go:68 +0x125
github.com/aws-observability/amazon-managed-grafana-migrator/internal/pkg/cli.discover({0x7ffe92411628, 0x9})
	/github/workspace/internal/pkg/cli/discover.go:28 +0xca
github.com/aws-observability/amazon-managed-grafana-migrator/internal/pkg/cli.BuildDiscoverCmd.func1(0x0?, {0x0?, 0x0?, 0x0?})
	/github/workspace/internal/pkg/cli/discover.go:58 +0x4c
github.com/aws-observability/amazon-managed-grafana-migrator/internal/pkg/cli.runCmdE.func1(0xc000004c00?, {0xc00006b2a0?, 0x2?, 0x2?})
	/github/workspace/internal/pkg/cli/discover.go:73 +0x7b
github.com/spf13/cobra.(*Command).execute(0xc000004c00, {0xc00006b280, 0x2, 0x2})
	/go/pkg/mod/github.com/spf13/[email protected]/command.go:940 +0x862
github.com/spf13/cobra.(*Command).ExecuteC(0xc000004900)
	/go/pkg/mod/github.com/spf13/[email protected]/command.go:1068 +0x3bd
github.com/spf13/cobra.(*Command).Execute(...)
	/go/pkg/mod/github.com/spf13/[email protected]/command.go:992
main.main()
	/github/workspace/main.go:22 +0x1e

Once the workspace completes creation, it works as expected:

[ec2-user@ip-172-31-0-89 ~]$ ./amazon-managed-grafana-migrator discover --region us-east-2
✔ Discovered 1 workspaces

Version: 9.4
Name: grafana
Endpoint: g-123456789.grafana-workspace.us-east-2.amazonaws.com

[ec2-user@ip-172-31-0-89 ~]$

Additional Information

No response

[Feature] ability to output dashboard/alerts configuration

Is your feature request related to a problem? Please describe

I used this tool very successfully for migrating workspaces, though during the process, I also realized that we don't currently store any "backups" of our dashboard/alert configuration. I've used other OSS tooling for dealing with dashboards in an automated way, but nothing is as slick as this one, so I was thinking about modelling something on it to get us an output of our entire workspace configuration...but if there's a way to do it in this tool, then that would be even better.

It's highly likely this isn't appropriate for the nature of this project, but I thought I'd ask anyway. 😸

Describe the solution you'd like

I'd love a secondary command to output to a local directory the configuration of our dashboards and alerts. Something like:

amazon-managed-grafana-migrator output \
    --src g-abcdef1234.grafana-workspace.eu-central-1.amazonaws.com \
    --folder workspace-backup

and I suppose that would be even more useful if there were some way to configure dashboards/alerts in a fresh workspace based on local configuration (but now this is serious scope creep 😆 )

Describe alternatives you've considered

I've considered using other tooling like https://github.com/Beam-Connectivity/grafana-dashboard-manager, but that doesn't seem to support alerts, and it's also not as smooth of a DX as this tool.

I've also considered just rolling my own, probably heavily based on the implementation here, because there are lots of nice things about it (progress in the terminal, temporary credentials, handles both dashboards and alerts).

Additional context

As I mentioned, I'm expecting this request won't be appropriate for this particular project, since it's only titled "amazon-managed-grafana-migrator", but no harm in asking. I'd even be willing to submit a PR myself, though I'm definitely by no means an expert Go developer.

Thanks again for this super cool tool...it saved me a lot of time 👍

EC2 Grafana(v9.2.0) to Amazon Manage Grafana(v9.4.7) dashboard transfer issue

Did you search for similar issues before submitting?

• Yes, I've searched similar issues on GitHub and didn't find any.

Release version

go install github.com/aws-observability/amazon-managed-grafana-migrator@latest

Is it a permission issue?

• I have a valid AWS CLI session.
• I'm using an IAM role with the necessary permissions.
• If migrating from a Grafana server, I used an active API key with ADMIN permissions.

What is your environment, configuration and the example used?

Getting error while transfering EC2 Grafana(v9.2.0) to Amazon Manage Grafana(v9.4.7)

Additional Information

Cureently we are using in-house grafana with AWS EC2 instances and we are planning to tansfer to AMG (amazon manage grafana) and getting dail tcp : lookup no such host error.

Tool is unable to identify service account that i created on Grafana server as well as AWS managed grafana.

As per the usage document of amazon-managed-grafana-migrator I am able to identify the AWS managed garafana via
#amazon-managed-grafana-migrator discover --region us-west-2

I have also created service account with below command-
#aws grafana create-workspace-service-account --workspace-id g-abcdef5678
--grafana-role ADMIN
--name grafana_migration

As soon as i execute migrate command i get below error-

Skipping API key creation for https://*****.com/

Creating service account token for service account grafana_migration

error: ValidationException: Invalid Service Account id: grafana_migration
{
RespMetadata: {
StatusCode: 400,
RequestID: "df3d54ae-d0e8-4509-b137-42c2668e3583"
},
Message_: "Invalid Service Account id: grafana_migration"
}

Migration command that am using is-
#amazon-managed-grafana-migrator migrate --src-url https://***.com/ --src-api-key glsa_T**************** --dst g-.grafana-workspace.us-west-2.amazonaws.com --dst-service-account-id grafana_migration

I have a question too, does this tool migrates the datasources configured passwords from source?

[Bug]: Alert evaluation interval overriden

Did you search for similar issues before submitting?

• Yes, I've searched similar issues on GitHub and didn't find any.

Release version

v0.1.8

Is it a permission issue?

• I have a valid AWS CLI session.
• I'm using an IAM role with the necessary permissions.
• If migrating from a Grafana server, I used an active API key with ADMIN permissions.

What is your environment, configuration and the example used?

Migrating alerting rules from Grafana server overrides the evaluation period and set to 1m

Additional Information

No response

[Bug]: grafana go sdk cannot unmarshal number -1 into Go struct field FolderDashboardSearchResponse.folderId of type uint

Did you search for similar issues before submitting?

• Yes, I've searched similar issues on GitHub and didn't find any.

Release version

0.1.9

Is it a permission issue?

• I have a valid AWS CLI session.
• I'm using an IAM role with the necessary permissions.
• If migrating from a Grafana server, I used an active API key with ADMIN permissions.

What is your environment, configuration and the example used?

Two grafana 8.4 instances trying to migrate from src to dst in order to upgrade the 'secondary' workspace first and be able to validate 9.4 works for us.

Additional Information

migrate throws an error for migrating dashboards. Seems to be thrown by https://github.com/aws-observability/amazon-managed-grafana-migrator/blob/main/internal/pkg/app/dashboards.go#L13

✔ Migrated 6 folders

Migrating dashboards:

Removing temporary API key for g-<src>

Removing temporary API key for g-<dst>
error: json: cannot unmarshal number -1 into Go struct field FolderDashboardSearchResponse.folderId of type uint