Prometheus

Use the Prometheus integration to give a workbench read-only access to metrics stored in Prometheus or a Prometheus-compatible backend, such as Thanos, Grafana Mimir, Cortex, or Amazon Managed Service for Prometheus. The agent runs PromQL range queries and can discover metric names, label names, and label values before it builds a query.

This guide uses the Plural Console UI. For the complete list of integrations and general tool behavior, see Workbench tools.

Prerequisites

Before you begin, make sure you have:

• A Prometheus-compatible endpoint that serves the Prometheus HTTP query API (/api/v1/...) and is reachable from your Plural Console deployment.
• Permission in Plural Console to create a configured tool and edit the target workbench.
• Credentials if the endpoint enforces authentication: a basic auth username and password, a bearer token or API key, or AWS credentials for Amazon Managed Service for Prometheus.
• A tenant ID if your backend is multi-tenant, such as Grafana Mimir or Cortex.
• An existing workbench, or permission to create one. See Setting up a workbench.

Prepare read-only access

Create a dedicated identity for the integration and grant it query access only. The tool reads metrics through the query and label endpoints; it never writes samples, rules, or configuration. If your endpoint sits behind a gateway or proxy, restrict the identity to the read path and block write or admin endpoints.

For Amazon Managed Service for Prometheus, the IAM identity that signs requests needs:

The AWS managed policy AmazonPrometheusQueryAccess includes both actions. Scope the policy's resource to the workspace ARN where possible.