private-connectivity

SKILL.md

Grafana Cloud Private Connectivity

Docs: https://grafana.com/docs/grafana-cloud/send-data/

Send metrics, logs, traces, and profiles to Grafana Cloud entirely over your cloud provider's private backbone — no public internet exposure, no egress fees.

Common Workflows

Setting up AWS PrivateLink (most common)

Find your service names. Grafana Cloud → Stack Details → "Send using AWS PrivateLink". Note one service name per signal type (metrics / logs / traces / profiles).

Create an Interface VPC Endpoint per signal type:

aws ec2 create-vpc-endpoint \
  --vpc-id vpc-12345 \
  --service-name com.amazonaws.vpce.us-east-1.vpce-svc-0abc123 \
  --vpc-endpoint-type Interface \
  --subnet-ids subnet-12345 \
  --security-group-ids sg-12345 \
  --private-dns-enabled

Verify private DNS resolves (CRITICAL — if this returns a public IP, Alloy will silently keep using the public path and you'll keep paying egress):

dig +short prometheus-private.us-east-0.grafana.net
# Expected: a 10.x.x.x / 172.16-31.x.x / 192.168.x.x address
# Public IP returned → check `private_dns_enabled = true` was set and the VPC has DNS hostnames enabled

Update Alloy to use the private endpoint:

prometheus.remote_write "cloud_private" {
  endpoint {
    url = "https://prometheus-private.us-east-0.grafana.net/api/prom/push"
    basic_auth {
      username = sys.env("PROM_USER")
      password = sys.env("GRAFANA_CLOUD_API_KEY")
    }
  }
}

loki.write "cloud_private" {
  endpoint {
    url = "https://logs-private.us-east-0.grafana.net/loki/api/v1/push"
    basic_auth {
      username = sys.env("LOKI_USER")
      password = sys.env("GRAFANA_CLOUD_API_KEY")
    }
  }
}

Confirm traffic is flowing over PrivateLink: check the VPC endpoint's CloudWatch metrics for BytesProcessed after Alloy starts pushing.

Full Terraform + per-signal-type endpoint resources in references/aws.md.

Setting up Azure Private Link / GCP Private Service Connect

Different provider, same shape: create the private endpoint → wait for approval → verify private DNS → update Alloy URLs. Full CLI + verification steps in references/azure-gcp.md.

Azure-specific prereq: Pre-register your Subscription IDs with Grafana Support before starting — without this the endpoint creation hangs at "Pending".

Prerequisites (all providers)

Grafana Cloud stack must be hosted on the same cloud provider (check: My Account → Stack → Details)

Create separate private endpoints for each signal type (metrics / logs / traces / profiles) — they have distinct service names

Same region only for AWS PrivateLink. Cross-region requires VPC peering first.

Choosing the right option

Scenario
Solution

Push from AWS
AWS PrivateLink

Push from Azure
Azure Private Link

Push from GCP
GCP Private Service Connect

Query private DB / Prometheus from Grafana
Private Data Source Connect (PDC) — see references/azure-gcp.md § PDC

References

references/aws.md — full AWS PrivateLink Terraform per signal type + endpoint verification (state + DNS)

references/azure-gcp.md — Azure Private Link + GCP Private Service Connect setup (Portal + CLI) + verification + Private Data Source Connect (PDC) for reverse-direction private data source queries