Isolating CloudWatch metrics for Different Customers

Question

Let's imagine a system like below:

• There is a cloud application collecting sensor metrics from various devices and saving these metrics into AWS's CloudWatch.
• These IoT devices may belong to either Customer X or Customer Y.
• A separate organization created for each customer in Grafana. So, they are isolated in terms of their dashboards.

The problem is that the metrics are stored in a common AWS account (even if they are stored in separate CloudWatch namespaces)! So, a member of Customer X can see the metrics of Customer Y by adding a datasource which accesses the namespace of the Customer Y.

Is there a mechanism to have separate credentials to securely isolate CloudWatch namespaces? Or another solution (other than having a separate AWS account for each customer) to fix this problem?

Answer 1

You can use IAM role with condition keys to limit access to particular CloudWatch namespace. So each Grafana organization will use own limited IAM role.