> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/destinations/amazon-managed-prometheus.md). # Amazon Managed Prometheus The Amazon Managed Service for Prometheus destination sends metrics from a Bindplane pipeline to an Amazon Managed Service for Prometheus (AMP) workspace. Metrics are delivered over Prometheus remote write, with requests signed using AWS Signature Version 4 (SigV4) against an IAM role the collector assumes. ### Supported Telemetry | Metrics | Logs | Traces | | ------- | ---- | ------ | | ✓ | | | ### Prerequisites This destination requires an existing AMP workspace, an IAM role the collector can assume that is permitted to write to that workspace, and the workspace region. * **AMP workspace**: Create a workspace in the [AWS console](https://aws.amazon.com/console/) or via the CLI. After it is created, copy the **Endpoint - remote write URL** from the workspace summary page. That value is the `Endpoint` parameter below. See [Create an Amazon Managed Service for Prometheus workspace](https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-onboard-create-workspace.html) and [Ingest Prometheus metrics to the workspace](https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-onboard-ingest-metrics.html). * **IAM role with remote-write permission**: The collector authenticates by assuming an IAM role. That role needs the `aps:RemoteWrite` action against the target workspace. The AWS managed policy `AmazonPrometheusRemoteWriteAccess` grants this, or you can attach an equivalent inline policy: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "aps:RemoteWrite", "Resource": "arn:aws:aps:::workspace/" } ] } ``` The role's trust policy must allow the principal whose credentials the collector uses to assume it. Copy the role's ARN for the `AWS Role` parameter. See [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html). * **Base AWS credentials**: SigV4 needs base credentials available to the collector before it can assume the role (for example, `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables, an instance profile, or another credential source the AWS SDK resolves). See [Specifying credentials](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html). * **Region**: The AWS region the workspace is located in. It also appears in the remote write endpoint. ### Configuration
Bindplane docs - Amazon Managed Service for Prometheus - image 1
**Metrics** | Parameter | Type | Required | Default | Description | | --------- | ------ | -------- | ----------- | -------------------------------------------------------------------------------------------------------------------------- | | Endpoint | String | Yes | *(empty)* | The remote write endpoint of the pre-existing AMP workspace. Copy it from the workspace's **Endpoint - remote write URL**. | | region | Enum | No | `us-west-2` | The AWS region the AMP workspace is located in. | | AWS Role | String | Yes | *(empty)* | The ARN of the AWS role the exporter assumes. The role must have permission to write to the AMP workspace. | **Advanced — AWS** | Parameter | Type | Required | Default | Description | | ------------ | ------ | -------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | STS Region | Enum | No | `none` | The region used when assuming the AWS role. Set this for cross-region authentication when the workspace is in a different region than the collector. `none` uses the default STS behavior. | | Session Name | String | No | *(empty)* | Name applied to the session when the exporter assumes the role. Useful to differentiate sessions when multiple principals can assume the same role. | **Advanced — Prometheus Remote Write** | Parameter | Type | Required | Default | Description | | -------------------------------------------- | ------- | -------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Compression | Enum | No | `gzip` | Compression algorithm for outgoing data. One of `none`, `gzip`, `deflate`, `snappy`, `zlib`, `zstd`. | | Namespace | String | No | *(empty)* | Prefix attached to each metric name. | | Max Batch Size | Integer | Yes | `3000000` | Maximum size, in bytes, of a metrics batch sent to the AMP endpoint. | | Convert Resource Attributes to Metric Labels | Boolean | No | `true` | When enabled, converts all resource attributes to metric labels. | | Add Unit and Type Suffixes | Boolean | No | `false` | When enabled, adds unit and type suffixes to metric names. | | Enable Created Metric | Boolean | No | `true` | When enabled, exports a `_created` metric for Summary, Histogram, and Monotonic Sum metric points. Only applies to Bindplane collectors prior to version 1.74.1 (OpenTelemetry Collector v0.123.0). | | Additional HTTP Headers | Map | No | *(empty)* | Additional headers attached to each HTTP request. `Content-Encoding`, `Content-Type`, `X-Prometheus-Remote-Write-Version`, and `User-Agent` cannot be changed. | | External Labels | Map | No | *(empty)* | Label names and values attached as metric attributes. | **Advanced — TLS** | Parameter | Type | Required | Default | Description | | ----------------------------------- | ------- | -------- | --------- | ----------------------------------------------------------------------------------------------------------------------- | | Enable TLS | Boolean | No | `false` | Whether to use TLS. | | Strict TLS Certificate Verification | Boolean | No | `false` | When enabled, requires TLS certificate verification. Relevant when `Enable TLS` is `true`. | | TLS Certificate Authority File | String | No | *(empty)* | Certificate authority used to validate TLS certificates. Relevant when `Strict TLS Certificate Verification` is `true`. | | Mutual TLS Authentication | Boolean | No | `false` | When enabled, requires TLS mutual authentication. Relevant when `Strict TLS Certificate Verification` is `true`. | | TLS Client Certificate File | String | Yes | *(empty)* | TLS certificate used for client authentication. Required and relevant when `Mutual TLS Authentication` is `true`. | | TLS Client Private Key File | String | Yes | *(empty)* | TLS private key used for client authentication. Required and relevant when `Mutual TLS Authentication` is `true`. | **Advanced — Remote Write Queue** | Parameter | Type | Required | Default | Description | | ---------------------------- | ------- | -------- | ------- | --------------------------------------------------------------------------------------------------------------------- | | Enable Remote Write Queue | Boolean | No | `true` | Whether to enable a remote write queue. Helps balance outgoing requests. | | Remote Write Queue Size | Integer | No | `10000` | The number of metrics that can be queued. Relevant when `Enable Remote Write Queue` is `true`. | | Remote Write Queue Consumers | Integer | No | `5` | The minimum number of workers used to fan out outgoing requests. Relevant when `Enable Remote Write Queue` is `true`. | **Advanced — Retry on Failure** | Parameter | Type | Required | Default | Description | | ----------------------- | ------- | -------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Enable Retry on Failure | Boolean | No | `true` | Resend telemetry that failed to transmit to the destination. | | Initial interval | Integer | No | `5` | Time, in seconds, to wait after the first failure before retrying. Relevant when `Enable Retry on Failure` is `true`. | | Max interval | Integer | No | `30` | Upper bound, in seconds, on the backoff interval. Relevant when `Enable Retry on Failure` is `true`. | | Max elapsed time | Integer | No | `300` | Maximum time, in seconds, spent trying to send a batch before giving up, to avoid a never-ending retry loop. Relevant when `Enable Retry on Failure` is `true`. | ### Examples Send metrics to an AMP workspace in `us-east-2`. The collector assumes the supplied role, applies a `bp_amp` namespace, uses `snappy` compression, and attaches an external label of `bp_agent=agent1`. The remote write queue and retry on failure use their defaults. ```yaml apiVersion: bindplane.observiq.com/v1 kind: Destination metadata: name: amazon-managed-prometheus spec: type: aws_managed_prometheus parameters: - name: endpoint value: https://aps-workspaces.us-east-2.amazonaws.com/workspaces/ws-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/api/v1/remote_write - name: region value: us-east-2 - name: arn value: arn:aws:iam::123456789012:role/bindplane-amp-remote-write - name: compression value: snappy - name: namespace value: bp_amp - name: external_labels value: bp_agent: agent1 ``` ### Configuration Tips * Set `region` to the region of your AMP workspace. When the collector runs in a different region than the workspace, set `STS Region` so the role assumption resolves correctly for cross-region authentication. * `snappy` is the compression Prometheus remote write traditionally uses. The default here is `gzip`. Match `Compression` to what your ingestion path and downstream tooling expect. * Keep `Enable Remote Write Queue` on to smooth bursts. Increase `Remote Write Queue Size` and `Remote Write Queue Consumers` if you see drops or backpressure under sustained high metric volume. ### Troubleshooting #### Authentication or permission denied Symptoms: requests fail with `AccessDenied`, `UnrecognizedClientException`, or HTTP 403. Solutions: 1. Confirm the assumed role's policy grants `aps:RemoteWrite` on the target workspace ARN. 2. Confirm the role's trust policy allows the principal whose base credentials the collector resolves to assume it, and that those base credentials are available to the collector. 3. Verify the `AWS Role` ARN is correct and matches the role you configured. #### Metrics not arriving or endpoint errors Symptoms: no data in the workspace, connection or HTTP errors in collector logs. Solutions: 1. Confirm the `Endpoint` is the workspace's **Endpoint - remote write URL**, including the full `/api/v1/remote_write` path. 2. Confirm `region` matches the workspace region. The region also appears in the endpoint hostname. #### Throttling or dropped data Symptoms: HTTP 429 responses, or gaps in metrics under high volume. Solutions: 1. AMP enforces an ingestion rate and burst limit per workspace. Reduce volume, or request a limit increase if you are exceeding the workspace quota. 2. Keep `Enable Retry on Failure` on so throttled batches are retried, and keep the remote write queue enabled to absorb bursts. ### Standalone Destination ```yaml apiVersion: bindplane.observiq.com/v1 kind: Destination metadata: name: amazon-managed-prometheus spec: type: aws_managed_prometheus parameters: - name: endpoint value: https://aps-workspaces.us-west-2.amazonaws.com/workspaces/ws-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/api/v1/remote_write - name: region value: us-west-2 - name: arn value: arn:aws:iam::123456789012:role/bindplane-amp-remote-write - name: max_batch_size_bytes value: 3000000 ``` ### Related Resources * [Prometheus Remote Write Exporter — OpenTelemetry Collector Contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/exporter/prometheusremotewriteexporter) * [Ingest Prometheus metrics to the workspace — Amazon Managed Service for Prometheus](https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-onboard-ingest-metrics.html) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bindplane.com/integrations/destinations/amazon-managed-prometheus.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.