diff --git a/pkg/tsdb/cloudwatch/credentials.go b/pkg/tsdb/cloudwatch/credentials.go
index <HASH>..<HASH> 100644
--- a/pkg/tsdb/cloudwatch/credentials.go
+++ b/pkg/tsdb/cloudwatch/credentials.go
@@ -60,8 +60,8 @@ func GetCredentials(dsInfo *DatasourceInfo) (*credentials.Credentials, error) {
 			[]credentials.Provider{
 				&credentials.EnvProvider{},
 				&credentials.SharedCredentialsProvider{Filename: "", Profile: dsInfo.Profile},
-				remoteCredProvider(stsSess),
 				webIdentityProvider(stsSess),
+				remoteCredProvider(stsSess),
 			})
 		stsConfig := &aws.Config{
 			Region:      aws.String(dsInfo.Region),
CloudWatch: Prefer webIdentity over EC2 role also when assuming a role (#<I>)

Same as #<I> but for assumed roles.

When using service accounts (webIdentity) on EKS in combination 

with assuming roles in other AWS accounts Grafana needs to retrieve 

the service account credentials first and then needs to assume the 

configured role.