CloudWatch: Re-implement authentication (#25548)

* CloudWatch: Revisit authentication

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Simplify auth code

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Use ARN

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Add Drone configuration

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Remove unused code

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Remove .drone.yml

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Fix external ID usage

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Fix issues after merge

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Remove stale code

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Remove stale code

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Use auth type enum

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Fix test snapshot

* Coordinate frontend and backend option names

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Remove old comments

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Fix front-end tests

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Introduce session cache

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Use constants

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Fix field alignment

* CloudWatch: Fix log message

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Tidy go.mod

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Handle arn auth type

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Fix role assumption duration

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Fix test

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Inline unnecessary constants

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Use serial comma in UI

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Inline unnecessary constants

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Fail if missing region

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Handle unconfigured region

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Log when using cached session

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Include region in cache key

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Add UI warnings for lecagy support

* Do not clear ARN fields whenging change authentication provider

* Graph NG: annotations display (#27972)

* Annotations support POC

* Fix markers memoization

* dev dashboard update

* Update public/app/plugins/panel/graph3/plugins/AnnotationsPlugin.tsx

* CloudWatch: Remove errors.BadRequest

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Undo unintentional change

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Remove log line

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Fix cache key computation

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Add region to cache key

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Improve log messages

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* CloudWatch: Add documentation

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Improve tooltip

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Improve docs

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Improve docs

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Improve docs

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Improve tooltip

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Add role assumption provisioning example

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Add upgrade notes

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Improve docs

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Apply suggestions from code review

Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>

* backend: use latest sdk (#28147)

fixes #27713 via https://github.com/grafana/grafana-plugin-sdk-go/pull/227

* Docs: Update Permissions documentation (#28144)

* removed overview.md

* content updates

* Update datasource_permissions.md

* update content

* content updates

* Update organization_roles.md

* Update docs/sources/enterprise/saml.md

Co-authored-by: Kyle Brandt <kyle@grafana.com>

* Update dashboard_folder_permissions.md

Co-authored-by: Kyle Brandt <kyle@grafana.com>

* area/grafana/toolkit: ci-package needs to use synchronous writes (#28148)

* ci needs to use synchronous writes or the file ends up with zero length

* <Enterprise Docs> Add instructions to upload license via UI (#28067)

* Add UI license upload option, reformat Enterprise license activation section

Added the option to upload a license file through the Server Admin UI, and did a little reformatting to make license activation look more like a process.

* Headers not bold, hyphens not asterisks

* Github: run metrics collector workflow every 10min (#28153)

* GithubActions: Updated cron schedule

* Updated

* Docs: Update explore docs: remove dot at the end of line (#28151)

HI - Removed Dot(.) at the end of line to make it consistent with other 2 points.

Thanks,
Ashish

* Fix frontend tests

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Fix frontend tests

Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com>

* Docs: Update upgrade notes

Co-authored-by: Sofia Papagiannaki <sofia@grafana.com>
Co-authored-by: Dominik Prokop <dominik.prokop@grafana.com>
Co-authored-by: Marcus Efraimsson <marcus.efraimsson@gmail.com>
Co-authored-by: Kyle Brandt <kyle@grafana.com>
Co-authored-by: Diana Payton <52059945+oddlittlebird@users.noreply.github.com>
Co-authored-by: Brian Gann <briangann@users.noreply.github.com>
Co-authored-by: Mitch Seaman <mjseaman@users.noreply.github.com>
Co-authored-by: Torkel Ödegaard <torkel@grafana.org>
Co-authored-by: Torkel Ödegaard <torkel@grafana.com>
Co-authored-by: ashishagarwal06 <34888589+ashishagarwal06@users.noreply.github.com>

docs/sources/installation/upgrading.md

@@ -277,3 +277,22 @@ For existing alert notification channels, there is no automatic migration of sto
 > Please note that when migrating a notification channel and later downgrading Grafana to an earlier version, the notification channel will not be able to read stored sensitive settings and, as a result, not function as expected.
 
 For provisioning of alert notification channels, refer to [Alert notification channels]({{< relref "../administration/provisioning.md#alert-notification-channels" >}}).
+
+## Upgrading to v7.3
+
+### AWS CloudWatch data source
+
+The AWS CloudWatch data source's authentication scheme has changed in Grafana 7.3. Most importantly the authentication method _ARN_ has been removed, and a new one has been added: _AWS SDK Default_. Existing data source configurations using the former will fallback to the latter. Assuming an IAM role will still work though, and the old _ARN_ method would use the default AWS SDK authentication method under the hood anyway.
+
+Since _ARN_ has been removed as an authentication method, we have instead made it into an option for providing the ARN of an IAM role to assume. This works independently of the authentication method you choose.
+
+The new authentication method, _AWS SDK Default_, uses the default AWS Go SDK credential chain, which at the time of writing looks for credentials in the following order:
+
+1. Environment variables.
+1. Shared credentials file.
+1. If your application uses an ECS task definition or RunTask API operation, IAM role for tasks.
+1. If your application is running on an Amazon EC2 instance, IAM role for Amazon EC2.
+
+The other authentication methods, _Access & secret key_ and _Credentials file_, have changed in regards to fallbacks. If these methods fail, they no longer fallback to other methods. e.g. environment variables. If you want fallbacks, you should use _AWS SDK Default_ instead.
+
+For more information and details, please refer to [Using AWS CloudWatch in Grafana]({{< relref "../datasources/cloudwatch.md#authentication" >}}).