Private Connectivity

Grafana Cloud Private Connectivity

Docs: https://grafana.com/docs/grafana-cloud/send-data/

Send metrics, logs, traces, and profiles to Grafana Cloud entirely over your cloud provider's private backbone — no public internet exposure, no egress fees.

Common Workflows

Setting up AWS PrivateLink (most common)

1. Find your service names. Grafana Cloud → Stack Details → "Send using AWS PrivateLink". Note one service name per signal type (metrics / logs / traces / profiles).

2. Create an Interface VPC Endpoint per signal type:

   aws ec2 create-vpc-endpoint \
     --vpc-id vpc-12345 \
     --service-name com.amazonaws.vpce.us-east-1.vpce-svc-0abc123 \
     --vpc-endpoint-type Interface \
     --subnet-ids subnet-12345 \
     --security-group-ids sg-12345 \
     --private-dns-enabled
   

3. Verify private DNS resolves (CRITICAL — if this returns a public IP, Alloy will silently keep using the public path and you'll keep paying egress):

   dig +short prometheus-private.us-east-0.grafana.net
   # Expected: a 10.x.x.x / 172.16-31.x.x / 192.168.x.x address
   # Public IP returned → check `private_dns_enabled = true` was set and the VPC has DNS hostnames enabled
   

4. Update Alloy to use the private endpoint:

   prometheus.remote_write "cloud_private" {
     endpoint {
       url = "https://prometheus-private.us-east-0.grafana.net/api/prom/push"
       basic_auth {
         username = sys.env("PROM_USER")
         password = sys.env("GRAFANA_CLOUD_API_KEY")
       }
     }
   }
   
   loki.write "cloud_private" {
     endpoint {
       url = "https://logs-private.us-east-0.grafana.net/loki/api/v1/push"
       basic_auth {
         username = sys.env("LOKI_USER")
         password = sys.env("GRAFANA_CLOUD_API_KEY")
       }
     }
   }
   

5. Confirm traffic is flowing over PrivateLink: check the VPC endpoint's CloudWatch metrics for BytesProcessed after Alloy starts pushing.

Full Terraform + per-signal-type endpoint resources in references/aws.md.

Setting up Azure Private Link / GCP Private Service Connect

Different provider, same shape: create the private endpoint → wait for approval → verify private DNS → update Alloy URLs. Full CLI + verification steps in references/azure-gcp.md.

Azure-specific prereq: Pre-register your Subscription IDs with Grafana Support before starting — without this the endpoint creation hangs at "Pending".

Prerequisites (all providers)

• Grafana Cloud stack must be hosted on the same cloud provider (check: My Account → Stack → Details)
• Create separate private endpoints for each signal type (metrics / logs / traces / profiles) — they have distinct service names
• Same region only for AWS PrivateLink. Cross-region requires VPC peering first.

Choosing the right option

References

• references/aws.md — full AWS PrivateLink Terraform per signal type + endpoint verification (state + DNS)
• references/azure-gcp.md — Azure Private Link + GCP Private Service Connect setup (Portal + CLI) + verification + Private Data Source Connect (PDC) for reverse-direction private data source queries