From b1ed2f58f9cb832a53e60da4e439c7a6cc8d21c3 Mon Sep 17 00:00:00 2001
From: Isabella Siu <isabella.siu@grafana.com>
Date: Thu, 18 Dec 2025 18:48:56 -0500
Subject: [PATCH] Make Grafana Assume Role the default auth when available

---
 src/components/ConnectionConfig.test.tsx | 17 +++++++++++++++++
 src/components/ConnectionConfig.tsx      |  6 +++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/components/ConnectionConfig.test.tsx b/src/components/ConnectionConfig.test.tsx
index 84b5ef8..8641e14 100644
--- a/src/components/ConnectionConfig.test.tsx
+++ b/src/components/ConnectionConfig.test.tsx
@@ -100,6 +100,23 @@ describe('ConnectionConfig', () => {
     });
   });
 
+  it('should auto select GrafanaAssumeRole if it is enabled and set as an allowed auth provider', async () => {
+    config.featureToggles.awsDatasourcesTempCredentials = true;
+    config.awsAllowedAuthProviders = [AwsAuthType.Credentials, AwsAuthType.GrafanaAssumeRole];
+    const onOptionsChange = jest.fn();
+    const props = getProps({ onOptionsChange });
+    const overwriteOptions = { ...props.options, type: 'cloudwatch' };
+    render(<ConnectionConfig {...props} options={overwriteOptions} />);
+    await waitFor(() => expect(screen.getByTestId('connection-config')).toBeInTheDocument());
+    expect(onOptionsChange).toHaveBeenCalledWith({
+      ...overwriteOptions,
+      jsonData: {
+        ...overwriteOptions.jsonData,
+        authType: AwsAuthType.GrafanaAssumeRole,
+      },
+    });
+  });
+
   it('should show secret field if auth type is keys', async () => {
     const props = getProps({ options: { jsonData: { authType: AwsAuthType.Keys } } });
     render(<ConnectionConfig {...props} />);
diff --git a/src/components/ConnectionConfig.tsx b/src/components/ConnectionConfig.tsx
index 8cac541..ae8ff20 100644
--- a/src/components/ConnectionConfig.tsx
+++ b/src/components/ConnectionConfig.tsx
@@ -63,11 +63,15 @@ export const ConnectionConfig: FC<ConnectionConfigProps> = (props: ConnectionCon
   useEffect(() => {
     // Make sure a authType exists in the current model
     if (!currentProvider && awsAllowedAuthProviders.length) {
+      let defaultAuthType = awsAllowedAuthProviders[0];
+      if (awsAllowedAuthProviders.includes(AwsAuthType.GrafanaAssumeRole)) {
+        defaultAuthType = AwsAuthType.GrafanaAssumeRole;
+      }
       onOptionsChange({
         ...options,
         jsonData: {
           ...options.jsonData,
-          authType: awsAllowedAuthProviders[0],
+          authType: defaultAuthType,
         },
       });
     }