Google Cloud Monitoring authentication methods
The Google Cloud Monitoring data source supports five authentication methods: Google JWT File (for running outside GCP with explicit credential control), GCE Default Service Account (for running on Google Compute Engine VMs), Forward OAuth Identity (for per-user queries with signed-in Google users), Workload Identity Federation (for Grafana Cloud with external OIDC providers), and Service Account Impersonation (for acting as a different service account than the one Grafana authenticates with).
Google JWT File authentication setup
To use Google JWT File authentication: create a GCP service account with the Monitoring Viewer role, download the JSON key file from the APIs and Services Credentials page, then in Grafana navigate to Google Cloud Monitoring data source configuration, select Google JWT File as the authentication type, upload the JSON key file via drag-and-drop or file browse, and click Save & test.
Multi-project access with single service account
To configure a single service account to access multiple GCP projects: create one service account and key file, note its email address, then in each additional target project navigate to IAM & Admin > IAM, click Grant access, enter the service account email, assign the Monitoring Viewer role, and save. Use the original key file in Grafana to query all configured projects.
GCE Default Service Account prerequisites
Before using GCE Default Service Account authentication, ensure: Grafana runs on a Google Compute Engine virtual machine, the VM has a service account assigned with the Monitoring Viewer role, and the VM has the Cloud Monitoring API scope enabled.
GCE instance configuration for Cloud Monitoring
To configure a GCE instance for Cloud Monitoring access: stop the VM, navigate to Compute Engine > VM instances and click the VM name, click Edit, select a service account with Monitoring Viewer role under Service account, under Access scopes select Set access for each API and enable Cloud Monitoring API (read-only), click Save, and restart the VM.
Forward OAuth Identity prerequisites
Before using Forward OAuth Identity: configure Grafana to sign users in with Google authentication, the Google OAuth client must request the https://www.googleapis.com/auth/monitoring.read scope in addition to openid email profile scopes, and each user querying the data source must have the Monitoring Viewer role (roles/monitoring.viewer) on the target GCP project.
Configure Google OAuth scope in Grafana
To add the Cloud Monitoring read scope to Google authentication in grafana.ini or custom.ini, add the following lines: [auth.google] and scopes = openid email profile https://www.googleapis.com/auth/monitoring.read. Alternatively, add the scope value to the Scopes field in the Grafana SSO settings UI.
OAuth scope change requires user re-authentication
After changing OAuth scopes, existing user sessions retain tokens issued under the old scope set. Each affected user must sign out, revoke the existing grant at https://myaccount.google.com/permissions, and sign in again to consent to the new scope. Otherwise, queries continue to fail with 403.
Forward OAuth Identity with Default project
When configuring Forward OAuth Identity authentication: select Forward OAuth Identity as the authentication type, enter the GCP project ID in the Default project field (required because the user's OAuth token carries no project context), and click Save & test.
Service Account Impersonation incompatible with Forward OAuth
Service account impersonation is not compatible with Forward OAuth Identity. Forward OAuth authenticates as the signed-in user, so there is no service account to impersonate.
Workload Identity Federation availability
Workload Identity Federation authentication method is available on Grafana Cloud only. Grafana Cloud exchanges the signed-in user's external OIDC token for a short-lived Google Cloud access token before the request reaches the plugin.
Workload Identity Federation configuration steps
To configure Workload Identity Federation: create a Workload Identity Pool and Provider in Google Cloud that trusts your OIDC provider with attribute mappings so google.subject maps to the relevant claim from your provider; configure Grafana Cloud's SSO integration against the same OIDC provider; in the Google Cloud Monitoring data source, select Workload Identity Federation, enter the full resource path of the provider (projects/<project-number>/locations/global/workloadIdentityPools/<pool-id>/providers/<provider-id>), optionally enter the service account email if using impersonation, enter the GCP project ID in Default project, and click Save & test.
Workload Identity Federation uses project number not ID
When entering the Workload Identity Pool Provider resource path in Grafana, use the project number (a numeric ID such as 123456789), not the project ID (such as my-project). The project number is available on the Google Cloud Console home page.
Workload Identity Federation limitation for background features
Credentials from Workload Identity Federation are tied to the signed-in user's active session with no long-lived credential available to the Grafana backend. This means features that run without a user present do not work, including alerting, scheduled reports, and public dashboards. Use a service account key (JWT) instead if these features are needed.
Service Account Impersonation use cases
Service Account Impersonation is useful for: accessing resources across multiple projects with a single configuration, following the principle of least privilege by separating authentication from authorization, and auditing and tracking which service account accessed specific resources.
Service Account Impersonation prerequisites
For service account impersonation, the caller service account must have the iam.serviceAccounts.getAccessToken permission on the target service account (included in the Service Account Token Creator role roles/iam.serviceAccountTokenCreator). The target service account must have the Monitoring Viewer role on the projects to access.
Configure Service Account Impersonation in Grafana
To configure service account impersonation: in GCP Console grant the caller service account the Service Account Token Creator role on the target service account, grant the target service account the Monitoring Viewer role on relevant projects, in Grafana navigate to the Google Cloud Monitoring data source configuration, configure authentication using either Google JWT File or GCE Default Service Account, enable Service Account Impersonation, enter the email address of the target service account, and click Save & test.
Google API requests made server-side by Grafana backend
All requests to Google APIs from the Google Cloud Monitoring data source are performed on the server-side by the Grafana backend.
Prerequisites for Google Cloud Monitoring data source
Before configuring authentication for Google Cloud Monitoring, ensure: a Google Cloud Platform project with the Monitoring API enabled, permissions to create service accounts or configure GCE instance settings in the GCP project, and access to the Grafana data source configuration page.