AWS Managed Service for Prometheus (AMP) Terraform module

January 8, 2026 ยท View on GitHub

Terraform module which creates AWS Managed Service for Prometheus (AMP) resources.

Usage

See examples directory for working examples to reference:

module "prometheus" {
  source = "terraform-aws-modules/managed-service-prometheus/aws"

  workspace_alias = "example"

  create_alert_manager     = true
  alert_manager_definition = <<-EOT
  alertmanager_config: |
    route:
      receiver: 'default'
    receivers:
      - name: 'default'
  EOT

  rule_group_namespaces = {
    first = {
      name = "rule-01"
      data = <<-EOT
      groups:
        - name: test
          rules:
          - record: metric:recording_rule
            expr: avg(rate(container_cpu_usage_seconds_total[5m]))
      EOT
    }
    second = {
      name = "rule-02"
      data = <<-EOT
      groups:
        - name: test
          rules:
          - record: metric:recording_rule
            expr: avg(rate(container_cpu_usage_seconds_total[5m]))
      EOT
    }
  }
}

Examples

Examples codified under the examples are intended to give users references for how to use the module(s) as well as testing/validating changes to the source code of the module. If contributing to the project, please be sure to make any appropriate updates to the relevant examples to allow maintainers to test your changes and to keep the examples up to date for users. Thank you!

Requirements

NameVersion
terraform>= 1.5.7
aws>= 6.28

Providers

NameVersion
aws>= 6.28

Modules

No modules.

Resources

NameType
aws_cloudwatch_log_group.thisresource
aws_prometheus_alert_manager_definition.thisresource
aws_prometheus_resource_policy.thisresource
aws_prometheus_rule_group_namespace.thisresource
aws_prometheus_workspace.thisresource
aws_prometheus_workspace_configuration.thisresource
aws_caller_identity.currentdata source
aws_iam_policy_document.resource_policydata source
aws_partition.currentdata source
aws_region.currentdata source
aws_service_principal.grafanadata source

Inputs

NameDescriptionTypeDefaultRequired
alert_manager_definitionThe alert manager definition that you want to be applied. See more in the AWS Docsstring`"alertmanager_config:\n route:\n receiver: 'default'\n receivers:\n - name: 'default'\n"`
cloudwatch_log_group_classSpecified the log class of the log group. Possible values are: STANDARD or INFREQUENT_ACCESSstringnullno
cloudwatch_log_group_kms_key_idIf a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html)stringnullno
cloudwatch_log_group_nameCustom name of CloudWatch log group for a service associated with the container definitionstringnullno
cloudwatch_log_group_retention_in_daysNumber of days to retain log events. Set to 0 to keep logs indefinitelynumber30no
cloudwatch_log_group_use_name_prefixDetermines whether the log group name should be used as a prefixboolfalseno
createDetermines whether a resources will be createdbooltrueno
create_alert_managerControls whether an Alert Manager definition is created along with the AMP workspacebooltrueno
create_resource_policyControls whether a resource policy is created along with the AMP workspacebooltrueno
create_workspaceDetermines whether a workspace will be created or to use an existing workspacebooltrueno
kms_key_arnThe ARN of the KMS Key to for encryption at reststringnullno
limits_per_label_setConfiguration block for setting limits on metrics with specific label sets
list(object({
label_set = map(string)
limits = object({
max_series = number
})
}))
nullno
logging_configurationThe logging configuration of the prometheus workspace.
object({
create_log_group = optional(bool, true)
log_group_arn = optional(string)
})
nullno
regionRegion where the resource(s) will be managed. Defaults to the Region set in the provider configurationstringnullno
resource_policy_statementsA map of IAM policy statements for custom permission usage
map(object({
sid = optional(string)
actions = optional(list(string))
not_actions = optional(list(string))
effect = optional(string, "Allow")
resources = optional(list(string))
not_resources = optional(list(string))
principals = optional(list(object({
type = string
identifiers = list(string)
})))
not_principals = optional(list(object({
type = string
identifiers = list(string)
})))
condition = optional(list(object({
test = string
variable = string
values = list(string)
})))
}))
nullno
retention_period_in_daysNumber of days to retain metric data in the workspacenumbernullno
rule_group_namespacesA map of one or more rule group namespace definitions
map(object({
name = string
data = string
}))
nullno
tagsA map of tags to add to all resourcesmap(string){}no
workspace_aliasThe alias of the prometheus workspace. See more in the AWS Docsstringnullno
workspace_idThe ID of an existing workspace to use when create_workspace is falsestring""no

Outputs

NameDescription
workspace_arnAmazon Resource Name (ARN) of the workspace
workspace_idIdentifier of the workspace
workspace_prometheus_endpointPrometheus endpoint available for this workspace

License

Apache-2.0 Licensed. See LICENSE.