Amazon EKS — AMP and AMG

2 minute read

Amazon Managed Service for Prometheus (AMP) and Amazon Managed Grafana (AMG) provide fully managed, scalable monitoring — no Prometheus/Grafana servers to manage yourself.

Amazon Managed Service for Prometheus (AMP)

AMP is a Prometheus-compatible managed service. You write metrics to it via remote write, and query with PromQL — same as self-managed Prometheus, but AWS handles availability, scaling, and storage.

Create a Workspace

aws amp create-workspace --alias my-eks-metrics
# Returns workspace ID: ws-12345678-abcd-efgh-ijkl-123456789012

Remote Write from Prometheus

Configure Prometheus to forward metrics to AMP:

# values.yaml for kube-prometheus-stack
prometheus:
  prometheusSpec:
    remoteWrite:
      - url: https://aps-workspaces.us-east-1.amazonaws.com/workspaces/ws-12345678/api/v1/remote_write
        sigv4:
          region: us-east-1
        queueConfig:
          maxSamplesPerSend: 1000
          maxShards: 200
          capacity: 2500

Remote Write from ADOT

exporters:
  prometheusremotewrite:
    endpoint: https://aps-workspaces.us-east-1.amazonaws.com/workspaces/ws-12345678/api/v1/remote_write
    auth:
      authenticator: sigv4auth

IRSA for AMP Access

eksctl create iamserviceaccount \
  --cluster my-cluster \
  --namespace monitoring \
  --name amp-writer-sa \
  --attach-policy-arn arn:aws:iam::aws:policy/AmazonPrometheusRemoteWriteAccess \
  --approve

Query AMP

# Using awscurl
awscurl --service aps --region us-east-1 \
  "https://aps-workspaces.us-east-1.amazonaws.com/workspaces/ws-12345678/api/v1/query?query=up"

Amazon Managed Grafana (AMG)

AMG provides managed Grafana with enterprise features — SSO, data source plugins, and VPC connectivity.

Create a Workspace

aws grafana create-workspace \
  --workspace-name my-eks-dashboards \
  --account-access-type CURRENT_ACCOUNT \
  --authentication-providers AWS_SSO \
  --permission-type SERVICE_MANAGED

Configure AMP as Data Source

  1. Open AMG workspace URL in browser
  2. Configuration → Data sources → Add data source
  3. Select Amazon Managed Service for Prometheus
  4. Enter AMP workspace URL: https://aps-workspaces.us-east-1.amazonaws.com/workspaces/ws-12345678
  5. Authentication: SigV4 (automatic with managed permissions)

SSO Integration

AMG integrates with AWS IAM Identity Center (SSO):

# Assign users
aws grafana update-workspace-authentication \
  --workspace-id g-12345678 \
  --authentication-providers AWS_SSO

# Grant admin access to a user
aws grafana update-permissions \
  --workspace-id g-12345678 \
  --update-instruction-batch '[{
    "action": "ADD",
    "role": "ADMIN",
    "users": [{"id": "user-id", "type": "SSO_USER"}]
  }]'

Self-Managed vs Managed Comparison

Feature Self-Managed (Prometheus + Grafana) Managed (AMP + AMG)
Availability You manage HA 99.9% SLA
Scaling Manual (add replicas, Thanos) Automatic
Storage EBS + Thanos/S3 Managed (unlimited)
Cost EC2 compute only Per metric sample ingested
Upgrade Helm upgrade Automatic
Multi-cluster Thanos or federation Single AMP workspace
SSO Manual (OIDC/LDAP) AWS IAM Identity Center
Setup effort Significant Minimal

When to Use What

Scenario Recommendation
Single small cluster Self-managed Prometheus + Grafana
Multiple clusters or large scale AMP + AMG
Need long-term retention (6+ months) AMP (or Thanos with S3)
Budget-constrained Self-managed (compute costs only)
Enterprise SSO required AMG
Already have Prometheus expertise Self-managed, consider AMP for storage

AMP Cost Estimate

Component Cost
Metric samples ingested $0.90 per 10M samples
Samples stored $0.03 per 10M per month
Samples queried $0.015 per 10M per query

For a typical 50-node cluster with ~100K active time series and 15s scrape interval:

  • ~576M samples/day → ~$52/month ingestion
  • Storage: ~$5/month (30-day retention)
  • Total: ~$57/month

Comparison: Self-managed Prometheus on a similar cluster typically needs 2-4 dedicated EC2 instances costing $100-400/month.

Best Practices

  1. Use AMP for multi-cluster — single workspace can aggregate metrics from many clusters
  2. Enable SigV4 authentication — secure remote write and query with IAM
  3. Set up AMG with SSO — enterprise-grade access control for dashboards
  4. Configure recording rules in AMP — pre-compute expensive queries
  5. Start self-managed, migrate to AMP when scale demands it — remote write is compatible

Updated:

You may also enjoy