Configure Azure Private Link

Send telemetry data from your Azure Virtual Network to Grafana Cloud via Azure Private Link in order to:

• Reduce your Azure egress costs.
• Improve security by keeping your data within the Azure network.

To use this feature, configure a Private Endpoint in your Azure Virtual Network. Your local agents can use this endpoint to route data to Grafana Cloud via Azure Private Link.

Prerequisites

To use Azure Private Link, you need a Grafana Cloud stack hosted on Azure and an Azure Virtual Network.

You need also to provide a list of Subscription IDs from where you plan to connect to Grafana Cloud.

Grafana Cloud stack on Azure

1. To check where your stack is hosted, navigate to your account in Grafana Cloud, and click Details for a given service, such as Prometheus or Loki.

2. If the region matches one of the Azure regions where Grafana Cloud is hosted, then your stack is hosted on Azure.

3. If your stack is not hosted on Azure, create a new stack, forward telemetry to it, and query it from your existing stack.

Azure Virtual Network

On the Azure Virtual Network, create a private endpoint to forward your telemetry data.

Subscription IDs

Before proceeding with Azure Private Link setup, contact Grafana Support and share from which Subscription IDs you plan to connect to Grafana Cloud services.

After Grafana Support confirms your Subscription IDs have been added to the Private Link allowlist, you can proceed setting up the connection.

Other regions

Azure Private Link supports cross-regional connections. If your infrastructure is hosted in a different Azure region than the one where Grafana is hosted, you can still benefit from Private Link.

Set up a Private Endpoint

Create a Private Endpoint in the Azure console, or provision one using Terraform.

Use the Azure Console

1. Open your Azure Console and navigate to Private Endpoints. 
2. Choose Create.
3. Select the subscription and resource group where your virtual network is.
4. Give the endpoint a name, for example, grafana-pl. 
5. Continue to the Resource tab and select Connect to an Azure resource by resource ID or alias.
6. In the Resource ID or alias field, enter the service alias from your Grafana Cloud stack.

Azure Region	Grafana Cluster	Service Alias
Central US	us-central-2	internal-ingress-nginx.fc1ffc23-597f-463b-910f-f11aaf43196b.centralus.azure.privatelinkservice
West Europe	prod-eu-west-3	internal-ingress-nginx.837de879-b929-40fe-a7e5-673072f4b71e.westeurope.azure.privatelinkservice

1. Continue to Virtual Network. Select your Virtual Network and Subnet. 
2. Choose Review + Create and proceed to create the resource. The Private Endpoint is created and after few minutes, Connection status should be displayed as Approved. If status stays as Awaiting Approval, the Subscription ID from where you are connecting is not included in the allowlist. Please contact Grafana Support to request the approval of the connection.
3. Under DNS Configuration, copy the local IP address of the private endpoint. You will need this IP later. 
4. Navigate now to Private DNS zones and click on Create. 
5. Select the subscription and resource group.
6. In Instance Details > Name, enter grafana.net and then proceed to create. 
7. Return to Private DNS Zone overview and add a Record Set.
8. In Name , introduce a wildcard *.
9. In IP Address, enter the local IP Address of the Private Endpoint..
10. Navigate to Virtual network links, then click on Add.
11. Name the network link, for example grafana-pl.
12. Select your subscription and Virtual Network. .
13. After you create this link, all endpoints under grafana.net resolve to the Private Endpoint IP, so all your telemetry data is sent to Grafana Cloud via Private Link.

Use Terraform

Use the following snippet to automate Private Endpoint setup in Azure using Terraform:

hcl

locals {
  region                    = "<your azure region>"
  resource_group_name       = "<your resource group name>"
  vnet_id                   = "<your virtual network id>"
  subnet_id                 = "<your subnet id>"
  privatelink_service_alias = "<private link service alias provided by Grafana>"
}

resource "azurerm_private_endpoint" "privatelink_grafana" {
  name                = "grafana-pl"
  location            = local.region
  resource_group_name = local.resource_group_name
  subnet_id           = local.subnet_id

  private_service_connection {
    name                           = "grafana-pl"
    is_manual_connection           = false
    private_connection_resource_id = local.privatelink_service_alias
  }
}

resource "azurerm_private_dns_zone" "privatelink_grafana" {
  name                = "grafana.net"
  resource_group_name = local.resource_group_name
}

resource "azurerm_private_dns_zone_virtual_network_link" "privatelink_grafana" {
  name                  = "grafana-pl"
  resource_group_name   = local.resource_group_name
  private_dns_zone_name = azurerm_private_dns_zone.privatelink_grafana.name
  virtual_network_id    = local.vnet_id
}

resource "azurerm_private_dns_a_record" "privatelink_grafana" {
  name                = "*"
  zone_name           = azurerm_private_dns_zone.privatelink_grafana.name
  resource_group_name = local.resource_group_name
  ttl                 = 300
  records             = [azurerm_private_endpoint.private_service_connection.private_ip_address]