diff --git a/plugins/inputs/cloudwatch/cloudwatch.go b/plugins/inputs/cloudwatch/cloudwatch.go
index 8e6384180a526..8edf2f8952def 100644
--- a/plugins/inputs/cloudwatch/cloudwatch.go
+++ b/plugins/inputs/cloudwatch/cloudwatch.go
@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/session"
 
 	"github.com/aws/aws-sdk-go/service/cloudwatch"
@@ -18,6 +19,8 @@ import (
 type (
 	CloudWatch struct {
 		Region      string            `toml:"region"`
+		AccessKey   string            `toml:"access_key"`
+		SecretKey   string            `toml:"secret_key"`
 		Period      internal.Duration `toml:"period"`
 		Delay       internal.Duration `toml:"delay"`
 		Namespace   string            `toml:"namespace"`
@@ -53,6 +56,15 @@ func (c *CloudWatch) SampleConfig() string {
   ## Amazon Region
   region = 'us-east-1'
 
+  ## Amazon Credentials
+  ## Credentials are loaded in the following order
+  ## 1) explicit credentials from 'access_key' and 'secret_key'
+  ## 2) environment variables
+  ## 3) shared credentials file
+  ## 4) EC2 Instance Profile
+  #access_key = ""
+  #secret_key = ""
+
   ## Requested CloudWatch aggregation Period (required - must be a multiple of 60s)
   period = '1m'
 
@@ -152,6 +164,9 @@ func (c *CloudWatch) initializeCloudWatch() error {
 	config := &aws.Config{
 		Region: aws.String(c.Region),
 	}
+	if c.AccessKey != "" || c.SecretKey != "" {
+		config.Credentials = credentials.NewStaticCredentials(c.AccessKey, c.SecretKey, "")
+	}
 
 	c.client = cloudwatch.New(session.New(config))
 	return nil
diff --git a/plugins/outputs/cloudwatch/cloudwatch.go b/plugins/outputs/cloudwatch/cloudwatch.go
index 75b2addf4e9d6..e4bfa06666325 100644
--- a/plugins/outputs/cloudwatch/cloudwatch.go
+++ b/plugins/outputs/cloudwatch/cloudwatch.go
@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/cloudwatch"
 
@@ -16,8 +17,10 @@ import (
 )
 
 type CloudWatch struct {
-	Region    string // AWS Region
-	Namespace string // CloudWatch Metrics Namespace
+	Region    string `toml:"region"`     // AWS Region
+	AccessKey string `toml:"access_key"` // Explicit AWS Access Key ID
+	SecretKey string `toml:"secret_key"` // Explicit AWS Secret Access Key
+	Namespace string `toml:"namespace"`  // CloudWatch Metrics Namespace
 	svc       *cloudwatch.CloudWatch
 }
 
@@ -25,6 +28,15 @@ var sampleConfig = `
   ## Amazon REGION
   region = 'us-east-1'
 
+  ## Amazon Credentials
+  ## Credentials are loaded in the following order
+  ## 1) explicit credentials from 'access_key' and 'secret_key'
+  ## 2) environment variables
+  ## 3) shared credentials file
+  ## 4) EC2 Instance Profile
+  #access_key = ""
+  #secret_key = ""
+
   ## Namespace for the CloudWatch MetricDatums
   namespace = 'InfluxData/Telegraf'
 `
@@ -41,6 +53,9 @@ func (c *CloudWatch) Connect() error {
 	Config := &aws.Config{
 		Region: aws.String(c.Region),
 	}
+	if c.AccessKey != "" || c.SecretKey != "" {
+		Config.Credentials = credentials.NewStaticCredentials(c.AccessKey, c.SecretKey, "")
+	}
 
 	svc := cloudwatch.New(session.New(Config))
 
diff --git a/plugins/outputs/kinesis/kinesis.go b/plugins/outputs/kinesis/kinesis.go
index a4b5e6a7b8810..fabec2402f41a 100644
--- a/plugins/outputs/kinesis/kinesis.go
+++ b/plugins/outputs/kinesis/kinesis.go
@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/kinesis"
 
@@ -17,6 +18,8 @@ import (
 
 type KinesisOutput struct {
 	Region       string `toml:"region"`
+	AccessKey    string `toml:"access_key"`
+	SecretKey    string `toml:"secret_key"`
 	StreamName   string `toml:"streamname"`
 	PartitionKey string `toml:"partitionkey"`
 	Format       string `toml:"format"`
@@ -27,6 +30,16 @@ type KinesisOutput struct {
 var sampleConfig = `
   ## Amazon REGION of kinesis endpoint.
   region = "ap-southeast-2"
+
+  ## Amazon Credentials
+  ## Credentials are loaded in the following order
+  ## 1) explicit credentials from 'access_key' and 'secret_key'
+  ## 2) environment variables
+  ## 3) shared credentials file
+  ## 4) EC2 Instance Profile
+  #access_key = ""
+  #secret_key = ""
+
   ## Kinesis StreamName must exist prior to starting telegraf.
   streamname = "StreamName"
   ## PartitionKey as used for sharding data.
@@ -65,6 +78,9 @@ func (k *KinesisOutput) Connect() error {
 	Config := &aws.Config{
 		Region: aws.String(k.Region),
 	}
+	if k.AccessKey != "" || k.SecretKey != "" {
+		Config.Credentials = credentials.NewStaticCredentials(k.AccessKey, k.SecretKey, "")
+	}
 	svc := kinesis.New(session.New(Config))
 
 	KinesisParams := &kinesis.ListStreamsInput{