| name | private-connectivity |
| license | Apache-2.0 |
| description | Set up private network connectivity to Grafana Cloud — AWS PrivateLink, Azure Private Link, GCP Private Service Connect, and Private Data Source Connect (PDC). Provisions VPC endpoints, private endpoints, or PSC forwarding rules per signal type (metrics / logs / traces / profiles); wires Alloy to push to the private DNS endpoint instead of the public one; verifies private DNS resolution + endpoint approval state. Use when sending telemetry to Grafana Cloud without traversing the public internet, eliminating cloud egress costs, meeting PCI-DSS / HIPAA / data-residency compliance, configuring PDC for private data-source queries, or connecting AWS / Azure / GCP workloads to Grafana — even when the user says "stop paying egress", "keep our telemetry off the public internet", or "PCI compliance for Grafana" without naming PrivateLink. |
Grafana Cloud Private Connectivity
Docs: https://grafana.com/docs/grafana-cloud/send-data/
Send metrics, logs, traces, and profiles to Grafana Cloud entirely over your cloud provider's private backbone — no public internet exposure, no egress fees.
Common Workflows
Setting up AWS PrivateLink (most common)
-
Find your service names. Grafana Cloud → Stack Details → "Send using AWS PrivateLink". Note one service name per signal type (metrics / logs / traces / profiles).
-
Create an Interface VPC Endpoint per signal type:
aws ec2 create-vpc-endpoint \
--vpc-id vpc-12345 \
--service-name com.amazonaws.vpce.us-east-1.vpce-svc-0abc123 \
--vpc-endpoint-type Interface \
--subnet-ids subnet-12345 \
--security-group-ids sg-12345 \
--private-dns-enabled
-
Verify private DNS resolves (CRITICAL — if this returns a public IP, Alloy will silently keep using the public path and you'll keep paying egress):
dig +short prometheus-private.us-east-0.grafana.net
-
Update Alloy to use the private endpoint:
prometheus.remote_write "cloud_private" {
endpoint {
url = "https://prometheus-private.us-east-0.grafana.net/api/prom/push"
basic_auth {
username = sys.env("PROM_USER")
password = sys.env("GRAFANA_CLOUD_API_KEY")
}
}
}
loki.write "cloud_private" {
endpoint {
url = "https://logs-private.us-east-0.grafana.net/loki/api/v1/push"
basic_auth {
username = sys.env("LOKI_USER")
password = sys.env("GRAFANA_CLOUD_API_KEY")
}
}
}
-
Confirm traffic is flowing over PrivateLink: check the VPC endpoint's CloudWatch metrics for BytesProcessed after Alloy starts pushing.
Full Terraform + per-signal-type endpoint resources in references/aws.md.
Setting up Azure Private Link / GCP Private Service Connect
Different provider, same shape: create the private endpoint → wait for approval → verify private DNS → update Alloy URLs. Full CLI + verification steps in references/azure-gcp.md.
Azure-specific prereq: Pre-register your Subscription IDs with Grafana Support before starting — without this the endpoint creation hangs at "Pending".
Prerequisites (all providers)
- Grafana Cloud stack must be hosted on the same cloud provider (check: My Account → Stack → Details)
- Create separate private endpoints for each signal type (metrics / logs / traces / profiles) — they have distinct service names
- Same region only for AWS PrivateLink. Cross-region requires VPC peering first.
Choosing the right option
| Scenario | Solution |
|---|
| Push from AWS | AWS PrivateLink |
| Push from Azure | Azure Private Link |
| Push from GCP | GCP Private Service Connect |
| Query private DB / Prometheus from Grafana | Private Data Source Connect (PDC) — see references/azure-gcp.md § PDC |
References
references/aws.md — full AWS PrivateLink Terraform per signal type + endpoint verification (state + DNS)references/azure-gcp.md — Azure Private Link + GCP Private Service Connect setup (Portal + CLI) + verification + Private Data Source Connect (PDC) for reverse-direction private data source queries
