diff --git a/pkg/tsdb/cloudwatch/credentials.go b/pkg/tsdb/cloudwatch/credentials.go
index 0c142bd4ea0..06848323fbb 100644
--- a/pkg/tsdb/cloudwatch/credentials.go
+++ b/pkg/tsdb/cloudwatch/credentials.go
@@ -11,6 +11,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds"
 	"github.com/aws/aws-sdk-go/aws/credentials/endpointcreds"
+	"github.com/aws/aws-sdk-go/aws/defaults"
 	"github.com/aws/aws-sdk-go/aws/ec2metadata"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/cloudwatch"
@@ -128,10 +129,10 @@ func remoteCredProvider(sess *session.Session) credentials.Provider {
 func ecsCredProvider(sess *session.Session, uri string) credentials.Provider {
 	const host = `169.254.170.2`
 
-	c := ec2metadata.New(sess)
+	d := defaults.Get()
 	return endpointcreds.NewProviderClient(
-		c.Client.Config,
-		c.Client.Handlers,
+		*d.Config,
+		d.Handlers,
 		fmt.Sprintf("http://%s%s", host, uri),
 		func(p *endpointcreds.Provider) { p.ExpiryWindow = 5 * time.Minute })
 }