From a98c129d056e234dc04615bbb860a534b81940e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johannes=20Br=C3=BCck?=
 <6677058+bruecktech@users.noreply.github.com>
Date: Fri, 24 Apr 2020 13:05:51 +0200
Subject: [PATCH] CloudWatch: Prefer webIdentity over EC2 role also when
 assuming a role (#23807)

Same as #23452 but for assumed roles.
When using service accounts (webIdentity) on EKS in combination
with assuming roles in other AWS accounts Grafana needs to retrieve
the service account credentials first and then needs to assume the
configured role.
---
 pkg/tsdb/cloudwatch/credentials.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/tsdb/cloudwatch/credentials.go b/pkg/tsdb/cloudwatch/credentials.go
index 427c23fa4bc..3ce8fb5761c 100644
--- a/pkg/tsdb/cloudwatch/credentials.go
+++ b/pkg/tsdb/cloudwatch/credentials.go
@@ -60,8 +60,8 @@ func GetCredentials(dsInfo *DatasourceInfo) (*credentials.Credentials, error) {
 			[]credentials.Provider{
 				&credentials.EnvProvider{},
 				&credentials.SharedCredentialsProvider{Filename: "", Profile: dsInfo.Profile},
-				remoteCredProvider(stsSess),
 				webIdentityProvider(stsSess),
+				remoteCredProvider(stsSess),
 			})
 		stsConfig := &aws.Config{
 			Region:      aws.String(dsInfo.Region),