Amazon Managed Prometheus

The Amazon Managed Service for Prometheus destination sends metrics from a Bindplane pipeline to an Amazon Managed Service for Prometheus (AMP) workspace. Metrics are delivered over Prometheus remote write, with requests signed using AWS Signature Version 4 (SigV4) against an IAM role the collector assumes.

Supported Telemetry Types

Metrics	Logs	Traces
✓

Prerequisites

This destination requires an existing AMP workspace, an IAM role the collector can assume that is permitted to write to that workspace, and the workspace region.

• AMP workspace: Create a workspace in the AWS console or via the CLI. After it is created, copy the Endpoint - remote write URL from the workspace summary page. That value is the Endpoint parameter below. See Create an Amazon Managed Service for Prometheus workspace and Ingest Prometheus metrics to the workspace.
• IAM role with remote-write permission: The collector authenticates by assuming an IAM role. That role needs the aps:RemoteWrite action against the target workspace. The AWS managed policy AmazonPrometheusRemoteWriteAccess grants this, or you can attach an equivalent inline policy:

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "aps:RemoteWrite",
        "Resource": "arn:aws:aps:<region>:<account-id>:workspace/<workspace-id>"
      }
    ]
  }

  The role's trust policy must allow the principal whose credentials the collector uses to assume it. Copy the role's ARN for the AWS Role parameter. See IAM roles.
• Base AWS credentials: SigV4 needs base credentials available to the collector before it can assume the role (for example, AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, an instance profile, or another credential source the AWS SDK resolves). See Specifying credentials.
• Region: The AWS region the workspace is located in. It also appears in the remote write endpoint.

Configuration

Metrics

Parameter	Type	Required	Default	Description
Endpoint	String	Yes	(empty)	The remote write endpoint of the pre-existing AMP workspace. Copy it from the workspace's Endpoint - remote write URL.
region	Enum	No	us-west-2	The AWS region the AMP workspace is located in.
AWS Role	String	Yes	(empty)	The ARN of the AWS role the exporter assumes. The role must have permission to write to the AMP workspace.

Advanced — AWS

Parameter	Type	Required	Default	Description
STS Region	Enum	No	none	The region used when assuming the AWS role. Set this for cross-region authentication when the workspace is in a different region than the collector. none uses the default STS behavior.
Session Name	String	No	(empty)	Name applied to the session when the exporter assumes the role. Useful to differentiate sessions when multiple principals can assume the same role.

Advanced — Prometheus Remote Write

Parameter	Type	Required	Default	Description
Compression	Enum	No	gzip	Compression algorithm for outgoing data. One of none, gzip, deflate, snappy, zlib, zstd.
Namespace	String	No	(empty)	Prefix attached to each metric name.
Max Batch Size	Integer	Yes	3000000	Maximum size, in bytes, of a metrics batch sent to the AMP endpoint.
Convert Resource Attributes to Metric Labels	Boolean	No	true	When enabled, converts all resource attributes to metric labels.
Add Unit and Type Suffixes	Boolean	No	false	When enabled, adds unit and type suffixes to metric names.
Enable Created Metric	Boolean	No	true	When enabled, exports a _created metric for Summary, Histogram, and Monotonic Sum metric points. Only applies to Bindplane collectors prior to version 1.74.1 (OpenTelemetry Collector v0.123.0).
Additional HTTP Headers	Map	No	(empty)	Additional headers attached to each HTTP request. Content-Encoding, Content-Type, X-Prometheus-Remote-Write-Version, and User-Agent cannot be changed.
External Labels	Map	No	(empty)	Label names and values attached as metric attributes.

Advanced — TLS

Parameter	Type	Required	Default	Description
Enable TLS	Boolean	No	false	Whether to use TLS.
Strict TLS Certificate Verification	Boolean	No	false	When enabled, requires TLS certificate verification. Relevant when Enable TLS is true.
TLS Certificate Authority File	String	No	(empty)	Certificate authority used to validate TLS certificates. Relevant when Strict TLS Certificate Verification is true.
Mutual TLS Authentication	Boolean	No	false	When enabled, requires TLS mutual authentication. Relevant when Strict TLS Certificate Verification is true.
TLS Client Certificate File	String	Yes	(empty)	TLS certificate used for client authentication. Required and relevant when Mutual TLS Authentication is true.
TLS Client Private Key File	String	Yes	(empty)	TLS private key used for client authentication. Required and relevant when Mutual TLS Authentication is true.

Advanced — Remote Write Queue

Parameter	Type	Required	Default	Description
Enable Remote Write Queue	Boolean	No	true	Whether to enable a remote write queue. Helps balance outgoing requests.
Remote Write Queue Size	Integer	No	10000	The number of metrics that can be queued. Relevant when Enable Remote Write Queue is true.
Remote Write Queue Consumers	Integer	No	5	The minimum number of workers used to fan out outgoing requests. Relevant when Enable Remote Write Queue is true.

Advanced — Retry on Failure

Parameter	Type	Required	Default	Description
Enable Retry on Failure	Boolean	No	true	Resend telemetry that failed to transmit to the destination.
Initial interval	Integer	No	5	Time, in seconds, to wait after the first failure before retrying. Relevant when Enable Retry on Failure is true.
Max interval	Integer	No	30	Upper bound, in seconds, on the backoff interval. Relevant when Enable Retry on Failure is true.
Max elapsed time	Integer	No	300	Maximum time, in seconds, spent trying to send a batch before giving up, to avoid a never-ending retry loop. Relevant when Enable Retry on Failure is true.

Examples

Send metrics to an AMP workspace in us-east-2. The collector assumes the supplied role, applies a bp_amp namespace, uses snappy compression, and attaches an external label of bp_agent=agent1. The remote write queue and retry on failure use their defaults.

apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  name: amazon-managed-prometheus
spec:
  type: aws_managed_prometheus
  parameters:
    - name: endpoint
      value: https://aps-workspaces.us-east-2.amazonaws.com/workspaces/ws-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/api/v1/remote_write
    - name: region
      value: us-east-2
    - name: arn
      value: arn:aws:iam::123456789012:role/bindplane-amp-remote-write
    - name: compression
      value: snappy
    - name: namespace
      value: bp_amp
    - name: external_labels
      value:
        bp_agent: agent1

Configuration Tips

• Set region to the region of your AMP workspace. When the collector runs in a different region than the workspace, set STS Region so the role assumption resolves correctly for cross-region authentication.
• snappy is the compression Prometheus remote write traditionally uses. The default here is gzip. Match Compression to what your ingestion path and downstream tooling expect.
• Keep Enable Remote Write Queue on to smooth bursts. Increase Remote Write Queue Size and Remote Write Queue Consumers if you see drops or backpressure under sustained high metric volume.

Troubleshooting

Authentication or permission denied

Symptoms: requests fail with AccessDenied, UnrecognizedClientException, or HTTP 403.

Solutions:

1. Confirm the assumed role's policy grants aps:RemoteWrite on the target workspace ARN.
2. Confirm the role's trust policy allows the principal whose base credentials the collector resolves to assume it, and that those base credentials are available to the collector.
3. Verify the AWS Role ARN is correct and matches the role you configured.

Metrics not arriving or endpoint errors

Symptoms: no data in the workspace, connection or HTTP errors in collector logs.

Solutions:

1. Confirm the Endpoint is the workspace's Endpoint - remote write URL, including the full /api/v1/remote_write path.
2. Confirm region matches the workspace region. The region also appears in the endpoint hostname.

Throttling or dropped data

Symptoms: HTTP 429 responses, or gaps in metrics under high volume.

Solutions:

1. AMP enforces an ingestion rate and burst limit per workspace. Reduce volume, or request a limit increase if you are exceeding the workspace quota.
2. Keep Enable Retry on Failure on so throttled batches are retried, and keep the remote write queue enabled to absorb bursts.

Standalone Destination

apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  name: amazon-managed-prometheus
spec:
  type: aws_managed_prometheus
  parameters:
    - name: endpoint
      value: https://aps-workspaces.us-west-2.amazonaws.com/workspaces/ws-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/api/v1/remote_write
    - name: region
      value: us-west-2
    - name: arn
      value: arn:aws:iam::123456789012:role/bindplane-amp-remote-write
    - name: max_batch_size_bytes
      value: 3000000

Related Resources

• Prometheus Remote Write Exporter — OpenTelemetry Collector Contrib
• Ingest Prometheus metrics to the workspace — Amazon Managed Service for Prometheus