Enable new permissions API

[julienduchesne]

Terraform provider for Grafana Issue: grafana/terraform-provider-grafana#1302

We migrated the provider to a new permissions API (available since Grafana 9.3) in the latest Terraform provider version but it's throwing 404s on AMG 9.4.7

Error: [POST /access-control/{resource}/{resourceID}] setResourcePermissions (status 404): {}

Is this API endpoint hidden on Amazon? Given that it does the exact same thing as the old endpoint (/api/folders/{uid}/permssions), coud we enable it?

[VermaPriyanka]

@julienduchesne You are referring to the access-control API endpoint: https://grafana.com/docs/grafana/latest/developers/http_api/access_control/, which requires RBAC to be enabled. Amazon Managed Grafana does not support RBAC yet.

[zmully]

👋 @VermaPriyanka can you please update on when this might be made available on AMG? This prevents us from updating the Terraform Grafana provider and so blocks our ability to create and route Alertmanager alarms to SNS topics.

IF you're not going to enable RBAC on AMG, then I would expect AWS to provider a forked Terraform provider that works around this issue.

[VermaPriyanka]

Are you seeing the issue in Amazon Managed Grafana version 10.4 as well?

[zmully]

@VermaPriyanka it does not work on 10.4 AFAICT. Where is this issue on the team's roadmap?

Huh. I'm getting inconsistent results when retesting 10.4. I'll update this if I am able to track this down.

In the meantime, @VermaPriyanka can you confirm that RBAC should be supported on 10.4 workspaces?

[VermaPriyanka]

v10.4 supports fixed RBAC roles, not custom roles, so some of the new Permissions API endpoints are exposed while some aren't. If you can share your use-case, I can look if there are endpoints you need that Managed Grafana isn't exposing, or if there are any ways around the same.