Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. AWS
  4. API Docs
  5. grafana
  6. Workspace
Viewing docs for AWS v7.53.0
published on Monday, Nov 2, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

aws.grafana.Workspace

aws logo aws logo
Viewing docs for AWS v7.53.0
published on Monday, Nov 2, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

    Provides an Amazon Managed Grafana workspace resource.

    Example Usage

    Basic configuration

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const assume = new aws.iam.Role("assume", {
    name: "grafana-assume",
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Sid: "",
            Principal: {
                Service: "grafana.amazonaws.com",
            },
        }],
    }),
});
const example = new aws.grafana.Workspace("example", {
    accountAccessType: "CURRENT_ACCOUNT",
    authenticationProviders: ["SAML"],
    permissionType: "SERVICE_MANAGED",
    roleArn: assume.arn,
});

    import pulumi
import json
import pulumi_aws as aws

assume = aws.iam.Role("assume",
    name="grafana-assume",
    assume_role_policy=json.dumps({
        "Version": "2012-10-17",
        "Statement": [{
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Sid": "",
            "Principal": {
                "Service": "grafana.amazonaws.com",
            },
        }],
    }))
example = aws.grafana.Workspace("example",
    account_access_type="CURRENT_ACCOUNT",
    authentication_providers=["SAML"],
    permission_type="SERVICE_MANAGED",
    role_arn=assume.arn)

    package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/grafana"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/iam"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"Version": "2012-10-17",
			"Statement": []map[string]interface{}{
				map[string]interface{}{
					"Action": "sts:AssumeRole",
					"Effect": "Allow",
					"Sid":    "",
					"Principal": map[string]string{
						"Service": "grafana.amazonaws.com",
					},
				},
			},
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		assume, err := iam.NewRole(ctx, "assume", &iam.RoleArgs{
			Name:             pulumi.String("grafana-assume"),
			AssumeRolePolicy: pulumi.String(json0),
		})
		if err != nil {
			return err
		}
		_, err = grafana.NewWorkspace(ctx, "example", &grafana.WorkspaceArgs{
			AccountAccessType: pulumi.String("CURRENT_ACCOUNT"),
			AuthenticationProviders: pulumi.StringArray{
				pulumi.String("SAML"),
			},
			PermissionType: pulumi.String("SERVICE_MANAGED"),
			RoleArn:        assume.Arn,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var assume = new Aws.Iam.Role("assume", new()
    {
        Name = "grafana-assume",
        AssumeRolePolicy = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["Version"] = "2012-10-17",
            ["Statement"] = new[]
            {
                new Dictionary<string, object?>
                {
                    ["Action"] = "sts:AssumeRole",
                    ["Effect"] = "Allow",
                    ["Sid"] = "",
                    ["Principal"] = new Dictionary<string, object?>
                    {
                        ["Service"] = "grafana.amazonaws.com",
                    },
                },
            },
        }),
    });

    var example = new Aws.Grafana.Workspace("example", new()
    {
        AccountAccessType = "CURRENT_ACCOUNT",
        AuthenticationProviders = new[]
        {
            "SAML",
        },
        PermissionType = "SERVICE_MANAGED",
        RoleArn = assume.Arn,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import com.pulumi.aws.grafana.Workspace;
import com.pulumi.aws.grafana.WorkspaceArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var assume = new Role("assume", RoleArgs.builder()
            .name("grafana-assume")
            .assumeRolePolicy(serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Action", "sts:AssumeRole"),
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Sid", ""),
                        jsonProperty("Principal", jsonObject(
                            jsonProperty("Service", "grafana.amazonaws.com")
                        ))
                    )))
                )))
            .build());

        var example = new Workspace("example", WorkspaceArgs.builder()
            .accountAccessType("CURRENT_ACCOUNT")
            .authenticationProviders("SAML")
            .permissionType("SERVICE_MANAGED")
            .roleArn(assume.arn())
            .build());

    }
}

    resources:
  example:
    type: aws:grafana:Workspace
    properties:
      accountAccessType: CURRENT_ACCOUNT
      authenticationProviders:
        - SAML
      permissionType: SERVICE_MANAGED
      roleArn: ${assume.arn}
  assume:
    type: aws:iam:Role
    properties:
      name: grafana-assume
      assumeRolePolicy:
        fn::toJSON:
          Version: 2012-10-17
          Statement:
            - Action: sts:AssumeRole
              Effect: Allow
              Sid: ""
              Principal:
                Service: grafana.amazonaws.com

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_grafana_workspace" "example" {
  lifecycle {
    create_before_destroy = true
  }
  account_access_type      = "CURRENT_ACCOUNT"
  authentication_providers = ["SAML"]
  permission_type          = "SERVICE_MANAGED"
  role_arn                 = aws_iam_role.assume.arn
}
resource "aws_iam_role" "assume" {
  lifecycle {
    create_before_destroy = true
  }
  name = "grafana-assume"
  assume_role_policy = jsonencode({
    "Version" = "2012-10-17"
    "Statement" = [{
      "Action" = "sts:AssumeRole"
      "Effect" = "Allow"
      "Sid"    = ""
      "Principal" = {
        "Service" = "grafana.amazonaws.com"
      }
    }]
  })
}

    Workspace configuration options

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.grafana.Workspace("example", {
    accountAccessType: "CURRENT_ACCOUNT",
    authenticationProviders: ["SAML"],
    permissionType: "SERVICE_MANAGED",
    roleArn: assume.arn,
    configuration: JSON.stringify({
        plugins: {
            pluginAdminEnabled: true,
        },
        unifiedAlerting: {
            enabled: false,
        },
    }),
});

    import pulumi
import json
import pulumi_aws as aws

example = aws.grafana.Workspace("example",
    account_access_type="CURRENT_ACCOUNT",
    authentication_providers=["SAML"],
    permission_type="SERVICE_MANAGED",
    role_arn=assume["arn"],
    configuration=json.dumps({
        "plugins": {
            "pluginAdminEnabled": True,
        },
        "unifiedAlerting": {
            "enabled": False,
        },
    }))

    package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/grafana"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		tmpJSON0, err := json.Marshal(map[string]map[string]bool{
			"plugins": map[string]bool{
				"pluginAdminEnabled": true,
			},
			"unifiedAlerting": map[string]bool{
				"enabled": false,
			},
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		_, err = grafana.NewWorkspace(ctx, "example", &grafana.WorkspaceArgs{
			AccountAccessType: pulumi.String("CURRENT_ACCOUNT"),
			AuthenticationProviders: pulumi.StringArray{
				pulumi.String("SAML"),
			},
			PermissionType: pulumi.String("SERVICE_MANAGED"),
			RoleArn:        pulumi.Any(assume.Arn),
			Configuration:  pulumi.String(json0),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Grafana.Workspace("example", new()
    {
        AccountAccessType = "CURRENT_ACCOUNT",
        AuthenticationProviders = new[]
        {
            "SAML",
        },
        PermissionType = "SERVICE_MANAGED",
        RoleArn = assume.Arn,
        Configuration = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["plugins"] = new Dictionary<string, object?>
            {
                ["pluginAdminEnabled"] = true,
            },
            ["unifiedAlerting"] = new Dictionary<string, object?>
            {
                ["enabled"] = false,
            },
        }),
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.grafana.Workspace;
import com.pulumi.aws.grafana.WorkspaceArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Workspace("example", WorkspaceArgs.builder()
            .accountAccessType("CURRENT_ACCOUNT")
            .authenticationProviders("SAML")
            .permissionType("SERVICE_MANAGED")
            .roleArn(assume.get("arn"))
            .configuration(serializeJson(
                jsonObject(
                    jsonProperty("plugins", jsonObject(
                        jsonProperty("pluginAdminEnabled", true)
                    )),
                    jsonProperty("unifiedAlerting", jsonObject(
                        jsonProperty("enabled", false)
                    ))
                )))
            .build());

    }
}

    resources:
  example:
    type: aws:grafana:Workspace
    properties:
      accountAccessType: CURRENT_ACCOUNT
      authenticationProviders:
        - SAML
      permissionType: SERVICE_MANAGED
      roleArn: ${assume.arn}
      configuration:
        fn::toJSON:
          plugins:
            pluginAdminEnabled: true
          unifiedAlerting:
            enabled: false

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_grafana_workspace" "example" {
  lifecycle {
    create_before_destroy = true
  }
  account_access_type      = "CURRENT_ACCOUNT"
  authentication_providers = ["SAML"]
  permission_type          = "SERVICE_MANAGED"
  role_arn                 = assume.arn
  configuration = jsonencode({
    "plugins" = {
      "pluginAdminEnabled" = true
    }
    "unifiedAlerting" = {
      "enabled" = false
    }
  })
}

    The optional argument configuration is a JSON string that disables the unified Grafana Alerting (Grafana version 10 or newer) and enables Plugin Management (Grafana version 9 or newer) on the Grafana Workspaces.

    For more information about using Grafana alerting, and the effects of turning it on or off, see Alerts in Grafana version 10.

    Create Workspace Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Workspace(name: string, args: WorkspaceArgs, opts?: CustomResourceOptions);
    @overload
def Workspace(resource_name: str,
              args: WorkspaceArgs,
              opts: Optional[ResourceOptions] = None)

@overload
def Workspace(resource_name: str,
              opts: Optional[ResourceOptions] = None,
              account_access_type: Optional[str] = None,
              authentication_providers: Optional[Sequence[str]] = None,
              permission_type: Optional[str] = None,
              description: Optional[str] = None,
              organization_role_name: Optional[str] = None,
              grafana_version: Optional[str] = None,
              kms_key_id: Optional[str] = None,
              name: Optional[str] = None,
              network_access_control: Optional[WorkspaceNetworkAccessControlArgs] = None,
              notification_destinations: Optional[Sequence[str]] = None,
              data_sources: Optional[Sequence[str]] = None,
              organizational_units: Optional[Sequence[str]] = None,
              configuration: Optional[str] = None,
              region: Optional[str] = None,
              role_arn: Optional[str] = None,
              stack_set_name: Optional[str] = None,
              tags: Optional[Mapping[str, str]] = None,
              vpc_configuration: Optional[WorkspaceVpcConfigurationArgs] = None)
    func NewWorkspace(ctx *Context, name string, args WorkspaceArgs, opts ...ResourceOption) (*Workspace, error)
    public Workspace(string name, WorkspaceArgs args, CustomResourceOptions? opts = null)
    public Workspace(String name, WorkspaceArgs args)
public Workspace(String name, WorkspaceArgs args, CustomResourceOptions options)

    type: aws:grafana:Workspace
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "aws_grafana_workspace" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args WorkspaceArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args WorkspaceArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args WorkspaceArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args WorkspaceArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args WorkspaceArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var awsWorkspaceResource = new Aws.Grafana.Workspace("awsWorkspaceResource", new()
{
    AccountAccessType = "string",
    AuthenticationProviders = new[]
    {
        "string",
    },
    PermissionType = "string",
    Description = "string",
    OrganizationRoleName = "string",
    GrafanaVersion = "string",
    KmsKeyId = "string",
    Name = "string",
    NetworkAccessControl = new Aws.Grafana.Inputs.WorkspaceNetworkAccessControlArgs
    {
        PrefixListIds = new[]
        {
            "string",
        },
        VpceIds = new[]
        {
            "string",
        },
    },
    NotificationDestinations = new[]
    {
        "string",
    },
    DataSources = new[]
    {
        "string",
    },
    OrganizationalUnits = new[]
    {
        "string",
    },
    Configuration = "string",
    Region = "string",
    RoleArn = "string",
    StackSetName = "string",
    Tags = 
    {
        { "string", "string" },
    },
    VpcConfiguration = new Aws.Grafana.Inputs.WorkspaceVpcConfigurationArgs
    {
        SecurityGroupIds = new[]
        {
            "string",
        },
        SubnetIds = new[]
        {
            "string",
        },
    },
});

    example, err := grafana.NewWorkspace(ctx, "awsWorkspaceResource", &grafana.WorkspaceArgs{
	AccountAccessType: pulumi.String("string"),
	AuthenticationProviders: pulumi.StringArray{
		pulumi.String("string"),
	},
	PermissionType:       pulumi.String("string"),
	Description:          pulumi.String("string"),
	OrganizationRoleName: pulumi.String("string"),
	GrafanaVersion:       pulumi.String("string"),
	KmsKeyId:             pulumi.String("string"),
	Name:                 pulumi.String("string"),
	NetworkAccessControl: &grafana.WorkspaceNetworkAccessControlArgs{
		PrefixListIds: pulumi.StringArray{
			pulumi.String("string"),
		},
		VpceIds: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
	NotificationDestinations: pulumi.StringArray{
		pulumi.String("string"),
	},
	DataSources: pulumi.StringArray{
		pulumi.String("string"),
	},
	OrganizationalUnits: pulumi.StringArray{
		pulumi.String("string"),
	},
	Configuration: pulumi.String("string"),
	Region:        pulumi.String("string"),
	RoleArn:       pulumi.String("string"),
	StackSetName:  pulumi.String("string"),
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	VpcConfiguration: &grafana.WorkspaceVpcConfigurationArgs{
		SecurityGroupIds: pulumi.StringArray{
			pulumi.String("string"),
		},
		SubnetIds: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
})

    resource "aws_grafana_workspace" "awsWorkspaceResource" {
  lifecycle {
    create_before_destroy = true
  }
  account_access_type      = "string"
  authentication_providers = ["string"]
  permission_type          = "string"
  description              = "string"
  organization_role_name   = "string"
  grafana_version          = "string"
  kms_key_id               = "string"
  name                     = "string"
  network_access_control = {
    prefix_list_ids = ["string"]
    vpce_ids        = ["string"]
  }
  notification_destinations = ["string"]
  data_sources              = ["string"]
  organizational_units      = ["string"]
  configuration             = "string"
  region                    = "string"
  role_arn                  = "string"
  stack_set_name            = "string"
  tags = {
    "string" = "string"
  }
  vpc_configuration = {
    security_group_ids = ["string"]
    subnet_ids         = ["string"]
  }
}

    var awsWorkspaceResource = new com.pulumi.aws.grafana.Workspace("awsWorkspaceResource", com.pulumi.aws.grafana.WorkspaceArgs.builder()
    .accountAccessType("string")
    .authenticationProviders("string")
    .permissionType("string")
    .description("string")
    .organizationRoleName("string")
    .grafanaVersion("string")
    .kmsKeyId("string")
    .name("string")
    .networkAccessControl(WorkspaceNetworkAccessControlArgs.builder()
        .prefixListIds("string")
        .vpceIds("string")
        .build())
    .notificationDestinations("string")
    .dataSources("string")
    .organizationalUnits("string")
    .configuration("string")
    .region("string")
    .roleArn("string")
    .stackSetName("string")
    .tags(Map.of("string", "string"))
    .vpcConfiguration(WorkspaceVpcConfigurationArgs.builder()
        .securityGroupIds("string")
        .subnetIds("string")
        .build())
    .build());

    aws_workspace_resource = aws.grafana.Workspace("awsWorkspaceResource",
    account_access_type="string",
    authentication_providers=["string"],
    permission_type="string",
    description="string",
    organization_role_name="string",
    grafana_version="string",
    kms_key_id="string",
    name="string",
    network_access_control={
        "prefix_list_ids": ["string"],
        "vpce_ids": ["string"],
    },
    notification_destinations=["string"],
    data_sources=["string"],
    organizational_units=["string"],
    configuration="string",
    region="string",
    role_arn="string",
    stack_set_name="string",
    tags={
        "string": "string",
    },
    vpc_configuration={
        "security_group_ids": ["string"],
        "subnet_ids": ["string"],
    })

    const awsWorkspaceResource = new aws.grafana.Workspace("awsWorkspaceResource", {
    accountAccessType: "string",
    authenticationProviders: ["string"],
    permissionType: "string",
    description: "string",
    organizationRoleName: "string",
    grafanaVersion: "string",
    kmsKeyId: "string",
    name: "string",
    networkAccessControl: {
        prefixListIds: ["string"],
        vpceIds: ["string"],
    },
    notificationDestinations: ["string"],
    dataSources: ["string"],
    organizationalUnits: ["string"],
    configuration: "string",
    region: "string",
    roleArn: "string",
    stackSetName: "string",
    tags: {
        string: "string",
    },
    vpcConfiguration: {
        securityGroupIds: ["string"],
        subnetIds: ["string"],
    },
});

    type: aws:grafana:Workspace
properties:
    accountAccessType: string
    authenticationProviders:
        - string
    configuration: string
    dataSources:
        - string
    description: string
    grafanaVersion: string
    kmsKeyId: string
    name: string
    networkAccessControl:
        prefixListIds:
            - string
        vpceIds:
            - string
    notificationDestinations:
        - string
    organizationRoleName: string
    organizationalUnits:
        - string
    permissionType: string
    region: string
    roleArn: string
    stackSetName: string
    tags:
        string: string
    vpcConfiguration:
        securityGroupIds:
            - string
        subnetIds:
            - string

    Workspace Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Workspace resource accepts the following input properties:

    AccountAccessType string
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    AuthenticationProviders List<string>
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    PermissionType string

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    Configuration string
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    DataSources List<string>
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    Description string
    Workspace description.
    GrafanaVersion string
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    KmsKeyId string
    ARN of the AWS KMS key for encrypting workspace data.
    Name string
    Grafana workspace name.
    NetworkAccessControl WorkspaceNetworkAccessControl
    Configuration for network access to your workspace. See networkAccessControl Block below.
    NotificationDestinations List<string>
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    OrganizationRoleName string
    Role name that the workspace uses to access resources through Amazon Organizations.
    OrganizationalUnits List<string>
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    RoleArn string
    IAM role ARN that the workspace assumes.
    StackSetName string
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    Tags Dictionary<string, string>
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    VpcConfiguration WorkspaceVpcConfiguration
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.
    AccountAccessType string
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    AuthenticationProviders []string
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    PermissionType string

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    Configuration string
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    DataSources []string
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    Description string
    Workspace description.
    GrafanaVersion string
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    KmsKeyId string
    ARN of the AWS KMS key for encrypting workspace data.
    Name string
    Grafana workspace name.
    NetworkAccessControl WorkspaceNetworkAccessControlArgs
    Configuration for network access to your workspace. See networkAccessControl Block below.
    NotificationDestinations []string
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    OrganizationRoleName string
    Role name that the workspace uses to access resources through Amazon Organizations.
    OrganizationalUnits []string
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    RoleArn string
    IAM role ARN that the workspace assumes.
    StackSetName string
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    Tags map[string]string
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    VpcConfiguration WorkspaceVpcConfigurationArgs
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.
    account_access_type string
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    authentication_providers list(string)
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    permission_type string

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    configuration string
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    data_sources list(string)
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    description string
    Workspace description.
    grafana_version string
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    kms_key_id string
    ARN of the AWS KMS key for encrypting workspace data.
    name string
    Grafana workspace name.
    network_access_control object
    Configuration for network access to your workspace. See networkAccessControl Block below.
    notification_destinations list(string)
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    organization_role_name string
    Role name that the workspace uses to access resources through Amazon Organizations.
    organizational_units list(string)
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    role_arn string
    IAM role ARN that the workspace assumes.
    stack_set_name string
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    tags map(string)
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    vpc_configuration object
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.
    accountAccessType String
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    authenticationProviders List<String>
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    permissionType String

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    configuration String
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    dataSources List<String>
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    description String
    Workspace description.
    grafanaVersion String
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    kmsKeyId String
    ARN of the AWS KMS key for encrypting workspace data.
    name String
    Grafana workspace name.
    networkAccessControl WorkspaceNetworkAccessControl
    Configuration for network access to your workspace. See networkAccessControl Block below.
    notificationDestinations List<String>
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    organizationRoleName String
    Role name that the workspace uses to access resources through Amazon Organizations.
    organizationalUnits List<String>
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    roleArn String
    IAM role ARN that the workspace assumes.
    stackSetName String
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    tags Map<String,String>
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    vpcConfiguration WorkspaceVpcConfiguration
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.
    accountAccessType string
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    authenticationProviders string[]
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    permissionType string

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    configuration string
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    dataSources string[]
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    description string
    Workspace description.
    grafanaVersion string
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    kmsKeyId string
    ARN of the AWS KMS key for encrypting workspace data.
    name string
    Grafana workspace name.
    networkAccessControl WorkspaceNetworkAccessControl
    Configuration for network access to your workspace. See networkAccessControl Block below.
    notificationDestinations string[]
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    organizationRoleName string
    Role name that the workspace uses to access resources through Amazon Organizations.
    organizationalUnits string[]
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    roleArn string
    IAM role ARN that the workspace assumes.
    stackSetName string
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    tags {[key: string]: string}
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    vpcConfiguration WorkspaceVpcConfiguration
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.
    account_access_type str
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    authentication_providers Sequence[str]
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    permission_type str

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    configuration str
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    data_sources Sequence[str]
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    description str
    Workspace description.
    grafana_version str
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    kms_key_id str
    ARN of the AWS KMS key for encrypting workspace data.
    name str
    Grafana workspace name.
    network_access_control WorkspaceNetworkAccessControlArgs
    Configuration for network access to your workspace. See networkAccessControl Block below.
    notification_destinations Sequence[str]
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    organization_role_name str
    Role name that the workspace uses to access resources through Amazon Organizations.
    organizational_units Sequence[str]
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    role_arn str
    IAM role ARN that the workspace assumes.
    stack_set_name str
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    tags Mapping[str, str]
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    vpc_configuration WorkspaceVpcConfigurationArgs
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.
    accountAccessType String
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    authenticationProviders List<String>
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    permissionType String

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    configuration String
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    dataSources List<String>
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    description String
    Workspace description.
    grafanaVersion String
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    kmsKeyId String
    ARN of the AWS KMS key for encrypting workspace data.
    name String
    Grafana workspace name.
    networkAccessControl Property Map
    Configuration for network access to your workspace. See networkAccessControl Block below.
    notificationDestinations List<String>
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    organizationRoleName String
    Role name that the workspace uses to access resources through Amazon Organizations.
    organizationalUnits List<String>
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    roleArn String
    IAM role ARN that the workspace assumes.
    stackSetName String
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    tags Map<String>
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    vpcConfiguration Property Map
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Workspace resource produces the following output properties:

    Arn string
    ARN of the Grafana workspace.
    Endpoint string
    Endpoint of the Grafana workspace.
    Id string
    The provider-assigned unique ID for this managed resource.
    SamlConfigurationStatus string
    Status of the SAML configuration.
    TagsAll Dictionary<string, string>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    Arn string
    ARN of the Grafana workspace.
    Endpoint string
    Endpoint of the Grafana workspace.
    Id string
    The provider-assigned unique ID for this managed resource.
    SamlConfigurationStatus string
    Status of the SAML configuration.
    TagsAll map[string]string
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    arn string
    ARN of the Grafana workspace.
    endpoint string
    Endpoint of the Grafana workspace.
    id string
    The provider-assigned unique ID for this managed resource.
    saml_configuration_status string
    Status of the SAML configuration.
    tags_all map(string)
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    arn String
    ARN of the Grafana workspace.
    endpoint String
    Endpoint of the Grafana workspace.
    id String
    The provider-assigned unique ID for this managed resource.
    samlConfigurationStatus String
    Status of the SAML configuration.
    tagsAll Map<String,String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    arn string
    ARN of the Grafana workspace.
    endpoint string
    Endpoint of the Grafana workspace.
    id string
    The provider-assigned unique ID for this managed resource.
    samlConfigurationStatus string
    Status of the SAML configuration.
    tagsAll {[key: string]: string}
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    arn str
    ARN of the Grafana workspace.
    endpoint str
    Endpoint of the Grafana workspace.
    id str
    The provider-assigned unique ID for this managed resource.
    saml_configuration_status str
    Status of the SAML configuration.
    tags_all Mapping[str, str]
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    arn String
    ARN of the Grafana workspace.
    endpoint String
    Endpoint of the Grafana workspace.
    id String
    The provider-assigned unique ID for this managed resource.
    samlConfigurationStatus String
    Status of the SAML configuration.
    tagsAll Map<String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.

    Look up Existing Workspace Resource

    Get an existing Workspace resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: WorkspaceState, opts?: CustomResourceOptions): Workspace
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_access_type: Optional[str] = None,
        arn: Optional[str] = None,
        authentication_providers: Optional[Sequence[str]] = None,
        configuration: Optional[str] = None,
        data_sources: Optional[Sequence[str]] = None,
        description: Optional[str] = None,
        endpoint: Optional[str] = None,
        grafana_version: Optional[str] = None,
        kms_key_id: Optional[str] = None,
        name: Optional[str] = None,
        network_access_control: Optional[WorkspaceNetworkAccessControlArgs] = None,
        notification_destinations: Optional[Sequence[str]] = None,
        organization_role_name: Optional[str] = None,
        organizational_units: Optional[Sequence[str]] = None,
        permission_type: Optional[str] = None,
        region: Optional[str] = None,
        role_arn: Optional[str] = None,
        saml_configuration_status: Optional[str] = None,
        stack_set_name: Optional[str] = None,
        tags: Optional[Mapping[str, str]] = None,
        tags_all: Optional[Mapping[str, str]] = None,
        vpc_configuration: Optional[WorkspaceVpcConfigurationArgs] = None) -> Workspace
    func GetWorkspace(ctx *Context, name string, id IDInput, state *WorkspaceState, opts ...ResourceOption) (*Workspace, error)
    public static Workspace Get(string name, Input<string> id, WorkspaceState? state, CustomResourceOptions? opts = null)
    public static Workspace get(String name, Output<String> id, WorkspaceState state, CustomResourceOptions options)
    resources:  _:    type: aws:grafana:Workspace    get:      id: ${id}
    import {
  to = aws_grafana_workspace.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccountAccessType string
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    Arn string
    ARN of the Grafana workspace.
    AuthenticationProviders List<string>
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    Configuration string
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    DataSources List<string>
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    Description string
    Workspace description.
    Endpoint string
    Endpoint of the Grafana workspace.
    GrafanaVersion string
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    KmsKeyId string
    ARN of the AWS KMS key for encrypting workspace data.
    Name string
    Grafana workspace name.
    NetworkAccessControl WorkspaceNetworkAccessControl
    Configuration for network access to your workspace. See networkAccessControl Block below.
    NotificationDestinations List<string>
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    OrganizationRoleName string
    Role name that the workspace uses to access resources through Amazon Organizations.
    OrganizationalUnits List<string>
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    PermissionType string

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    RoleArn string
    IAM role ARN that the workspace assumes.
    SamlConfigurationStatus string
    Status of the SAML configuration.
    StackSetName string
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    Tags Dictionary<string, string>
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    TagsAll Dictionary<string, string>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    VpcConfiguration WorkspaceVpcConfiguration
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.
    AccountAccessType string
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    Arn string
    ARN of the Grafana workspace.
    AuthenticationProviders []string
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    Configuration string
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    DataSources []string
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    Description string
    Workspace description.
    Endpoint string
    Endpoint of the Grafana workspace.
    GrafanaVersion string
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    KmsKeyId string
    ARN of the AWS KMS key for encrypting workspace data.
    Name string
    Grafana workspace name.
    NetworkAccessControl WorkspaceNetworkAccessControlArgs
    Configuration for network access to your workspace. See networkAccessControl Block below.
    NotificationDestinations []string
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    OrganizationRoleName string
    Role name that the workspace uses to access resources through Amazon Organizations.
    OrganizationalUnits []string
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    PermissionType string

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    RoleArn string
    IAM role ARN that the workspace assumes.
    SamlConfigurationStatus string
    Status of the SAML configuration.
    StackSetName string
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    Tags map[string]string
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    TagsAll map[string]string
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    VpcConfiguration WorkspaceVpcConfigurationArgs
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.
    account_access_type string
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    arn string
    ARN of the Grafana workspace.
    authentication_providers list(string)
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    configuration string
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    data_sources list(string)
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    description string
    Workspace description.
    endpoint string
    Endpoint of the Grafana workspace.
    grafana_version string
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    kms_key_id string
    ARN of the AWS KMS key for encrypting workspace data.
    name string
    Grafana workspace name.
    network_access_control object
    Configuration for network access to your workspace. See networkAccessControl Block below.
    notification_destinations list(string)
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    organization_role_name string
    Role name that the workspace uses to access resources through Amazon Organizations.
    organizational_units list(string)
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    permission_type string

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    role_arn string
    IAM role ARN that the workspace assumes.
    saml_configuration_status string
    Status of the SAML configuration.
    stack_set_name string
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    tags map(string)
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    tags_all map(string)
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    vpc_configuration object
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.
    accountAccessType String
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    arn String
    ARN of the Grafana workspace.
    authenticationProviders List<String>
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    configuration String
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    dataSources List<String>
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    description String
    Workspace description.
    endpoint String
    Endpoint of the Grafana workspace.
    grafanaVersion String
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    kmsKeyId String
    ARN of the AWS KMS key for encrypting workspace data.
    name String
    Grafana workspace name.
    networkAccessControl WorkspaceNetworkAccessControl
    Configuration for network access to your workspace. See networkAccessControl Block below.
    notificationDestinations List<String>
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    organizationRoleName String
    Role name that the workspace uses to access resources through Amazon Organizations.
    organizationalUnits List<String>
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    permissionType String

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    roleArn String
    IAM role ARN that the workspace assumes.
    samlConfigurationStatus String
    Status of the SAML configuration.
    stackSetName String
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    tags Map<String,String>
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    tagsAll Map<String,String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    vpcConfiguration WorkspaceVpcConfiguration
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.
    accountAccessType string
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    arn string
    ARN of the Grafana workspace.
    authenticationProviders string[]
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    configuration string
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    dataSources string[]
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    description string
    Workspace description.
    endpoint string
    Endpoint of the Grafana workspace.
    grafanaVersion string
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    kmsKeyId string
    ARN of the AWS KMS key for encrypting workspace data.
    name string
    Grafana workspace name.
    networkAccessControl WorkspaceNetworkAccessControl
    Configuration for network access to your workspace. See networkAccessControl Block below.
    notificationDestinations string[]
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    organizationRoleName string
    Role name that the workspace uses to access resources through Amazon Organizations.
    organizationalUnits string[]
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    permissionType string

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    roleArn string
    IAM role ARN that the workspace assumes.
    samlConfigurationStatus string
    Status of the SAML configuration.
    stackSetName string
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    tags {[key: string]: string}
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    tagsAll {[key: string]: string}
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    vpcConfiguration WorkspaceVpcConfiguration
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.
    account_access_type str
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    arn str
    ARN of the Grafana workspace.
    authentication_providers Sequence[str]
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    configuration str
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    data_sources Sequence[str]
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    description str
    Workspace description.
    endpoint str
    Endpoint of the Grafana workspace.
    grafana_version str
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    kms_key_id str
    ARN of the AWS KMS key for encrypting workspace data.
    name str
    Grafana workspace name.
    network_access_control WorkspaceNetworkAccessControlArgs
    Configuration for network access to your workspace. See networkAccessControl Block below.
    notification_destinations Sequence[str]
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    organization_role_name str
    Role name that the workspace uses to access resources through Amazon Organizations.
    organizational_units Sequence[str]
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    permission_type str

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    role_arn str
    IAM role ARN that the workspace assumes.
    saml_configuration_status str
    Status of the SAML configuration.
    stack_set_name str
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    tags Mapping[str, str]
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    tags_all Mapping[str, str]
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    vpc_configuration WorkspaceVpcConfigurationArgs
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.
    accountAccessType String
    Type of account access for the workspace. Valid values are CURRENT_ACCOUNT and ORGANIZATION. If ORGANIZATION is specified, then organizationalUnits must also be present.
    arn String
    ARN of the Grafana workspace.
    authenticationProviders List<String>
    Authentication providers for the workspace. Valid values are AWS_SSO, SAML, or both.
    configuration String
    Configuration string for the workspace that you create. For more information about the format and configuration options available, see Working in your Grafana workspace.
    dataSources List<String>
    Data sources for the workspace. Valid values are AMAZON_OPENSEARCH_SERVICE, ATHENA, CLOUDWATCH, PROMETHEUS, REDSHIFT, SITEWISE, TIMESTREAM, TWINMAKER, XRAY
    description String
    Workspace description.
    endpoint String
    Endpoint of the Grafana workspace.
    grafanaVersion String
    Version of Grafana to support in the new workspace. Supported values are 9.4, 10.4, 12.4 and 13.2. If not specified, defaults to the latest version.
    kmsKeyId String
    ARN of the AWS KMS key for encrypting workspace data.
    name String
    Grafana workspace name.
    networkAccessControl Property Map
    Configuration for network access to your workspace. See networkAccessControl Block below.
    notificationDestinations List<String>
    Notification destinations. If a data source is specified here, Amazon Managed Grafana will create IAM roles and permissions needed to use these destinations. Must be set to SNS.
    organizationRoleName String
    Role name that the workspace uses to access resources through Amazon Organizations.
    organizationalUnits List<String>
    Amazon Organizations organizational units that the workspace is authorized to use data sources from.
    permissionType String

    Permission type of the workspace. If SERVICE_MANAGED is specified, the IAM roles and IAM policy attachments are generated automatically. If CUSTOMER_MANAGED is specified, the IAM roles and IAM policy attachments will not be created.

    The following arguments are optional:

    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    roleArn String
    IAM role ARN that the workspace assumes.
    samlConfigurationStatus String
    Status of the SAML configuration.
    stackSetName String
    AWS CloudFormation stack set name that provisions IAM roles to be used by the workspace.
    tags Map<String>
    Key-value mapping of resource tags. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level
    tagsAll Map<String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    vpcConfiguration Property Map
    Configuration settings for an Amazon VPC that contains data sources for your Grafana workspace to connect to. See vpcConfiguration Block below.

    Supporting Types

    WorkspaceNetworkAccessControl, WorkspaceNetworkAccessControlArgs

    PrefixListIds List<string>
    An array of prefix list IDs.
    VpceIds List<string>
    An array of Amazon VPC endpoint IDs for the workspace. The only VPC endpoints that can be specified here are interface VPC endpoints for Grafana workspaces (using the com.amazonaws.[region].grafana-workspace service endpoint). Other VPC endpoints will be ignored.
    PrefixListIds []string
    An array of prefix list IDs.
    VpceIds []string
    An array of Amazon VPC endpoint IDs for the workspace. The only VPC endpoints that can be specified here are interface VPC endpoints for Grafana workspaces (using the com.amazonaws.[region].grafana-workspace service endpoint). Other VPC endpoints will be ignored.
    prefix_list_ids list(string)
    An array of prefix list IDs.
    vpce_ids list(string)
    An array of Amazon VPC endpoint IDs for the workspace. The only VPC endpoints that can be specified here are interface VPC endpoints for Grafana workspaces (using the com.amazonaws.[region].grafana-workspace service endpoint). Other VPC endpoints will be ignored.
    prefixListIds List<String>
    An array of prefix list IDs.
    vpceIds List<String>
    An array of Amazon VPC endpoint IDs for the workspace. The only VPC endpoints that can be specified here are interface VPC endpoints for Grafana workspaces (using the com.amazonaws.[region].grafana-workspace service endpoint). Other VPC endpoints will be ignored.
    prefixListIds string[]
    An array of prefix list IDs.
    vpceIds string[]
    An array of Amazon VPC endpoint IDs for the workspace. The only VPC endpoints that can be specified here are interface VPC endpoints for Grafana workspaces (using the com.amazonaws.[region].grafana-workspace service endpoint). Other VPC endpoints will be ignored.
    prefix_list_ids Sequence[str]
    An array of prefix list IDs.
    vpce_ids Sequence[str]
    An array of Amazon VPC endpoint IDs for the workspace. The only VPC endpoints that can be specified here are interface VPC endpoints for Grafana workspaces (using the com.amazonaws.[region].grafana-workspace service endpoint). Other VPC endpoints will be ignored.
    prefixListIds List<String>
    An array of prefix list IDs.
    vpceIds List<String>
    An array of Amazon VPC endpoint IDs for the workspace. The only VPC endpoints that can be specified here are interface VPC endpoints for Grafana workspaces (using the com.amazonaws.[region].grafana-workspace service endpoint). Other VPC endpoints will be ignored.

    WorkspaceVpcConfiguration, WorkspaceVpcConfigurationArgs

    SecurityGroupIds List<string>
    The list of Amazon EC2 security group IDs attached to the Amazon VPC for your Grafana workspace to connect.
    SubnetIds List<string>
    The list of Amazon EC2 subnet IDs created in the Amazon VPC for your Grafana workspace to connect.
    SecurityGroupIds []string
    The list of Amazon EC2 security group IDs attached to the Amazon VPC for your Grafana workspace to connect.
    SubnetIds []string
    The list of Amazon EC2 subnet IDs created in the Amazon VPC for your Grafana workspace to connect.
    security_group_ids list(string)
    The list of Amazon EC2 security group IDs attached to the Amazon VPC for your Grafana workspace to connect.
    subnet_ids list(string)
    The list of Amazon EC2 subnet IDs created in the Amazon VPC for your Grafana workspace to connect.
    securityGroupIds List<String>
    The list of Amazon EC2 security group IDs attached to the Amazon VPC for your Grafana workspace to connect.
    subnetIds List<String>
    The list of Amazon EC2 subnet IDs created in the Amazon VPC for your Grafana workspace to connect.
    securityGroupIds string[]
    The list of Amazon EC2 security group IDs attached to the Amazon VPC for your Grafana workspace to connect.
    subnetIds string[]
    The list of Amazon EC2 subnet IDs created in the Amazon VPC for your Grafana workspace to connect.
    security_group_ids Sequence[str]
    The list of Amazon EC2 security group IDs attached to the Amazon VPC for your Grafana workspace to connect.
    subnet_ids Sequence[str]
    The list of Amazon EC2 subnet IDs created in the Amazon VPC for your Grafana workspace to connect.
    securityGroupIds List<String>
    The list of Amazon EC2 security group IDs attached to the Amazon VPC for your Grafana workspace to connect.
    subnetIds List<String>
    The list of Amazon EC2 subnet IDs created in the Amazon VPC for your Grafana workspace to connect.

    Import

    Using pulumi import, import Grafana Workspace using the workspace’s id. For example:

    $ pulumi import aws:grafana/workspace:Workspace example g-2054c75a02

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo aws logo
    Viewing docs for AWS v7.53.0
    published on Monday, Nov 2, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial