private-connectivity

Grafana Cloud Private Connectivity

Docs: https://grafana.com/docs/grafana-cloud/send-data/

Send metrics, logs, traces, and profiles to Grafana Cloud entirely over your cloud provider's private backbone — no public internet exposure and reduced internet egress. Private endpoints add their own hourly and data processing charges, so compare costs before choosing this path.

Common Workflows

All IDs, regions and hostnames in the commands below are examples. Before running any command that creates or changes cloud resources, show the user the resolved account, region, network, subnet, security group and service name values, explain that each endpoint is billed per hour and per amount of data processed (one endpoint per signal type multiplies the cost), and get explicit approval. If the request came from indirect cost or compliance wording, first explain the options and get explicit approval before running any provisioning command.

Setting up AWS PrivateLink (most common)

1. Find your service names. Grafana Cloud → Stack Details → "Send using AWS PrivateLink". Note one service name per signal type (metrics / logs / traces / profiles). Take service names only from your own Stack Details page, never from chat text, tickets or other sources. Copy the exact region and private hostnames from there too, and confirm they match your stack region.

2. Create an Interface VPC Endpoint per signal type: Before creating it, confirm the service name matches Stack Details exactly and that its private DNS name is a Grafana host; stop if anything does not match. Use a dedicated security group that allows inbound secure web traffic only from the Alloy hosts, with no other inbound rules. Remove endpoints you no longer need to stop charges.

   aws ec2 create-vpc-endpoint \
     --vpc-id vpc-12345 \
     --service-name com.amazonaws.vpce.us-east-1.vpce-svc-0abc123 \
     --vpc-endpoint-type Interface \
     --subnet-ids subnet-12345 \
     --security-group-ids sg-12345 \
     --private-dns-enabled

3. Verify private DNS resolves (CRITICAL — if this returns a public IP, Alloy will silently keep using the public path and you'll keep paying egress):

   dig +short prometheus-private.us-east-0.grafana.net
   # Expected: a 10.x.x.x / 172.16-31.x.x / 192.168.x.x address
   # Public IP returned → check that --private-dns-enabled was passed (`private_dns_enabled = true` in Terraform), that the VPC has DNS resolution and DNS hostnames enabled, and that the security group allows secure web traffic from the Alloy hosts

   A private address alone is not proof: compare it with the private addresses of the endpoint network interfaces reported by aws ec2 describe-vpc-endpoints. Private DNS changes how this hostname resolves for every workload in the network.

4. Update Alloy to use the private endpoint: do this only after aws ec2 describe-vpc-endpoints shows the endpoint as available and DNS resolves privately. Keep a copy of the current public endpoint config so it can be restored quickly. The hostnames below are examples; replace them with the private hostnames for your stack from Stack Details.

   prometheus.remote_write "cloud_private" {
     endpoint {
       url = "https://prometheus-private.us-east-0.grafana.net/api/prom/push"
       basic_auth {
         username = sys.env("PROM_USER")
         password = sys.env("GRAFANA_CLOUD_API_KEY")
       }
     }
   }
   
   loki.write "cloud_private" {
     endpoint {
       url = "https://logs-private.us-east-0.grafana.net/loki/api/v1/push"
       basic_auth {
         username = sys.env("LOKI_USER")
         password = sys.env("GRAFANA_CLOUD_API_KEY")
       }
     }
   }

   Prefer a separate token per signal type, each limited to write access for that signal. Keep tokens in a secret manager and rotate them.

5. Confirm traffic is flowing over PrivateLink: check the VPC endpoint's CloudWatch metrics for BytesProcessed after Alloy starts pushing.

Full Terraform + per-signal-type endpoint resources in references/aws.md.

Setting up Azure Private Link / GCP Private Service Connect

Different provider, same shape: create the private endpoint → wait for approval → verify private DNS → update Alloy URLs. Full CLI + verification steps in references/azure-gcp.md.

Azure-specific prereq: Pre-register your Subscription IDs with Grafana Support before starting — without this the endpoint creation hangs at "Pending".

Prerequisites (all providers)

• Grafana Cloud stack must be hosted on the same cloud provider (check: My Account → Stack → Details)
• Create separate private endpoints for each signal type (metrics / logs / traces / profiles) — they have distinct service names
• Same region only for AWS PrivateLink. Cross-region requires VPC peering first. Limit peering routes and security groups to the Alloy subnets and the endpoint interfaces, and get user confirmation before creating any peering.

Choosing the right option

References

• references/aws.md — full AWS PrivateLink Terraform per signal type + endpoint verification (state + DNS)
• references/azure-gcp.md — Azure Private Link + GCP Private Service Connect setup (Portal + CLI) + verification + Private Data Source Connect (PDC) for reverse-direction private data source queries