Instrumenting a Bedrock application produces more signals than one CloudWatch dashboard holds. Invocation metrics sit in CloudWatch, retrieval latency in OpenSearch, traces in X-Ray, evaluation scores behind an Athena query. Managed Grafana is the surface that reads all four at once and draws them together.
AWS describes the job as “holistic observability systems”, built from “operational metrics”, “performance tracing”, “FM interaction tracing” and “business impact metrics with custom dashboards”. Know the service by its boundaries. Use it to look, use CloudWatch alarms to act, and use Amazon Quick Sight when the readers are occasional and numerous.
Flash card
Amazon Managed Grafana: a managed Grafana workspace that queries metrics, logs and traces from several sources and draws them on one dashboard, with AWS running the upgrades, scaling and availability.
- Data sources include CloudWatch metrics and logs, Amazon OpenSearch Service, Amazon Athena, AWS X-Ray and Prometheus, so one panel set can put Bedrock invocation metrics beside vector-store search latency, agent traces, and a business number from Athena over the invocation logs.
- Sign-in goes through IAM Identity Center or a SAML 2.0 provider rather than IAM users, which is how a product owner gets a read-only view without an AWS console login and how access follows the identities an organisation already has.
- Pricing is per active user per workspace per month, USD$9 for an editor or administrator and USD$5 for a viewer. An active user is anyone who signed in or made an API request during the billing cycle, and every workspace is billed for at least one editor, so a wide occasional audience raises the bill and the workspace stays a team surface.
- {“It does Grafana alerting as well as display, though CloudWatch alarms stay the route into AWS-native automation”=>”an alarm publishes to an SNS topic or triggers an EC2 or Auto Scaling action, and every alarm state change is delivered to EventBridge for a rule to match.”}
- A workspace reads across accounts and Regions. Service-managed permissions for an organisation create a member role in each selected account, or a data source takes a cross-account role ARN in its Assume Role ARN field, so a shared view of several environments does not need data copied into one place.
Pick it when
Pick it when the view has to join sources a CloudWatch dashboard cannot reach, or when a scenario names existing Grafana dashboards or engineers who already work in Grafana.
It's the wrong answer when
It is the wrong answer for alarm-driven automation inside AWS, which is a CloudWatch alarm with SNS or EventBridge; for business intelligence delivered to many occasional readers on a scheduled refresh with embedding, which is Amazon Quick Sight, the former QuickSight; and for a single-account view over CloudWatch alone, where a CloudWatch dashboard is cheaper and already there.