Agent Skills

private-connectivity

devopsgrafana3.4K installs

Set up private network connectivity to Grafana Cloud — AWS PrivateLink, Azure Private Link, GCP Private Service Connect, and Private Data Source Connect (PDC). Provisions VPC endpoints, private endpoints, or PSC forwarding rules per signal type (metrics / logs / traces / profiles); wires Alloy to push to the private DNS endpoint instead of the public one; verifies private DNS resolution + endpoint approval state. Use when sending telemetry to Grafana Cloud without traversing the public internet,

Install

npx skills add https://github.com/grafana/skills --skill private-connectivity
SKILL.md

Grafana Cloud Private Connectivity

Docs: https://grafana.com/docs/grafana-cloud/send-data/

Send metrics, logs, traces, and profiles to Grafana Cloud entirely over your cloud provider's private backbone — no public internet exposure, no egress fees.

Common Workflows

Setting up AWS PrivateLink (most common)

  1. Find your service names. Grafana Cloud → Stack Details → "Send using AWS PrivateLink". Note one service name per signal type (metrics / logs / traces / profiles).

  2. Create an Interface VPC Endpoint per signal type:

    aws ec2 create-vpc-endpoint \
  --vpc-id vpc-12345 \
  --service-name com.amazonaws.vpce.us-east-1.vpce-svc-0abc123 \
  --vpc-endpoint-type Interface \
  --subnet-ids subnet-12345 \
  --security-group-ids sg-12345 \
  --private-dns-enabled

  3. Verify private DNS resolves (CRITICAL — if this returns a public IP, Alloy will silently keep using the public path and you'll keep paying egress):

    dig +short prometheus-private.us-east-0.grafana.net
# Expected: a 10.x.x.x / 172.16-31.x.x / 192.168.x.x address
# Public IP returned → check `private_dns_enabled = true` was set and the VPC has DNS hostnames enabled

  4. Update Alloy to use the private endpoint:

    prometheus.remote_write "cloud_private" {
  endpoint {
    url = "https://prometheus-private.us-east-0.grafana.net/api/prom/push"
    basic_auth {
      username = sys.env("PROM_USER")
      password = sys.env("GRAFANA_CLOUD_API_KEY")
    }
  }
}

loki.write "cloud_private" {
  endpoint {
    url = "https://logs-private.us-east-0.grafana.net/loki/api/v1/push"
    basic_auth {
      username = sys.env("LOKI_USER")
      password = sys.env("GRAFANA_CLOUD_API_KEY")
    }
  }
}

  5. Confirm traffic is flowing over PrivateLink: check the VPC endpoint's CloudWatch metrics for BytesProcessed after Alloy starts pushing.

Full Terraform + per-signal-type endpoint resources in references/aws.md.

Setting up Azure Private Link / GCP Private Service Connect

Different provider, same shape: create the private endpoint → wait for approval → verify private DNS → update Alloy URLs. Full CLI + verification steps in references/azure-gcp.md.

Azure-specific prereq: Pre-register your Subscription IDs with Grafana Support before starting — without this the endpoint creation hangs at "Pending".

Prerequisites (all providers)

  • Grafana Cloud stack must be hosted on the same cloud provider (check: My Account → Stack → Details)
  • Create separate private endpoints for each signal type (metrics / logs / traces / profiles) — they have distinct service names
  • Same region only for AWS PrivateLink. Cross-region requires VPC peering first.

Choosing the right option

Scenario Solution
Push from AWS AWS PrivateLink
Push from Azure Azure Private Link
Push from GCP GCP Private Service Connect
Query private DB / Prometheus from Grafana Private Data Source Connect (PDC) — see references/azure-gcp.md § PDC

References

  • references/aws.md — full AWS PrivateLink Terraform per signal type + endpoint verification (state + DNS)
  • references/azure-gcp.md — Azure Private Link + GCP Private Service Connect setup (Portal + CLI) + verification + Private Data Source Connect (PDC) for reverse-direction private data source queries

Related skills

azure-diagnosticsmicrosoft608KDebug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, troubleshoot functions, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, aazure-preparemicrosoft608KPrepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azazure-aimicrosoft608KUse for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.azure-deploymicrosoft607KExecute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: \"run azd up\", \"run azd deploy\", \"execute deployment\",

Search skills and MCP servers

Fuzzy search across 23,137 skills and servers