AWS Cloud Operations Blog

Announcing inbound network access control in Amazon Managed Grafana

Many customers that use Amazon Managed Grafana have a need to restrict the Grafana workspace public access and enable fine-grained control to allow which traffic sources can reach the Grafana workspace. Today, we are announcing Amazon Managed Grafana’s new feature that supports inbound network access control. This enables you to secure Grafana workspaces using VPC Endpoints and customer-managed prefix lists that restricts the inbound network traffic reaching your workspaces.

Amazon Virtual Private Cloud (Amazon VPC) endpoints for Amazon Managed Grafana simplify access to the Grafana workspace from within a VPC by providing configurable and highly reliable secure connections to workspace URL. This allows you to securely connect to the Grafana workspace URL within the AWS network, with all network traffic staying on the global AWS backbone and never traversing the public internet.

Managed prefix list is a set of one or more CIDR (classless inter-domain routing) blocks. A customer-managed prefix list simplifies security by enabling you to configure a set of CIDR blocks that can access your Amazon Managed Grafana workspace URL.

VPC endpoint

VPC Interface endpoint allows you to connect to Amazon Managed Grafana privately, as if it is running in your own VPC. A VPC endpoint enables customers to privately connect to supported AWS services via AWS PrivateLink. AWS PrivateLink provides private connectivity between virtual private clouds (VPCs), supported AWS services, and your on-premises networks without exposing your traffic to the public internet. Amazon VPC instances do not require public ip-addresses to communicate with resources of the service. Traffic between an Amazon VPC and a service does not leave the Amazon network.

  • VPC endpoint — The entry point in your VPC that enables you to connect privately to a service.
  • AWS PrivateLink — A technology that provides private connectivity between VPCs and services.

Customer-managed prefix list

With this release, you can configure Amazon Managed Grafana workspace URL to be accessible only from specific IPv4 address ranges. This provides an additional layer of security for your Amazon Managed Grafana and acts as a firewall by preventing public and or unauthorized inbound access to your Amazon Managed Grafana workspace URL. Consider this as a network firewall `allow-list` where a list of ip-addresses that are configured on a firewall or router explicitly allow inbound traffic with no restrictions but every other inbound traffic is blocked.

Architecture

By default, the Grafana workspace URL is publicly reachable. The following diagram illustrates how you will restrict the workspace public access and enable network access control using VPC interface endpoints and customer-managed prefix list.

The following diagram illustrates the inbound network access control in Amazon Managed Grafana

Figure 1. The following diagram illustrates the inbound network access control in Amazon Managed Grafana.

VPC interface endpoints:

  • User / private client connects to Grafana workspace via VPC interface endpoint.
  • AWS PrivateLink provides connectivity to Amazon Managed Grafana and traffic does not leave the Amazon network.

Customer-manager prefix list:

  • Grafana workspace URL is accessible only from the ip-address ranges that are configured in the customer-managed prefix list.
  • Every other inbound access is denied.

Configure Grafana workspace with network access control

You can add network access control to an existing workspace or configure it as part of the initial creation of the workspace. Grafana workspace network access can be controlled by either through a VPC interface endpoint or a customer managed prefix list or a combination of both. Details are given in the following sections.

Create a VPC interface endpoint

While creating the VPC interface endpoint, select the service category AWS services and choose Amazon Managed Grafana service name com.amazonaws.region.grafana and the VPC in which to create the endpoint. For more information about interface endpoints, see create a VPC endpoint. Check out this blog and the self-paced workshop to learn about the benefits of using Amazon VPC endpoints.

Create a customer-managed prefix list

To allow ip-addresses, you must create one or more prefix lists in Amazon VPC with the list of IP ranges to allow. Amazon Managed Grafana only supports IPv4 addresses in prefix lists, not IPv6. Private ip-address ranges such as 10.0.0.0/16 are ignored. To allow those hosts to reach the workspace, create a VPC endpoint for your workspaces and give them access. For more information about prefix lists, see create a prefix list and prefix lists concepts and rules.

Configure network access control for a Grafana workspace

  • In your Amazon Managed Grafana console, select the name of the workspace that you want to configure network access control.
  • In the Network access control tab, under Network access control, click Edit.

    Network access control

    Figure 2. Network access control

  • Choose Restricted access.
  • Select Prefix list option and enter a Prefix list ID of your choice and/or select VPC endpoint option and enter your preferred VPC endpoint ID. You can add up to 5 prefix lists and 5 VPC endpoints.
  • Choose Save changes to complete the setup.

Conclusion

With this launch, you will be able to restrict inbound network access to Grafana workspace providing you that extra layer of security without any performance impact or operational overhead. To learn more about this launch, see What’s New post and Amazon Managed Grafana user guide for network access control.

  1. Check out One Observability Workshop aimed at providing a hands-on experience for you on the wide variety of toolsets AWS offers to setup monitoring and observability on your applications.
  2. Refer best practices for AWS Observability to learn more about prescriptive guidance and recommendations with implementation examples.
  3. If you are a Terraform shop, check out AWS Observability accelerator for Terraform which is a set of Terraform modules to help you configure Observability for your workloads with AWS Observability services.

We are here to help and if you need further assistance, reach out to AWS Support and your AWS account team.

About the authors

Arun Chandapillai

Arun Chandapillai is a Senior Infrastructure Architect who is a diversity and inclusion champion. He is passionate about helping his customers accelerate IT modernization through business-first Cloud adoption strategies and successfully build, deploy, and manage applications and infrastructure in the Cloud. Arun is an automotive enthusiast, an avid speaker, and a philanthropist who believes in ‘you get (back) what you give’. LinkedIn: /arunchandapillai

Mengdi Chen

Mengdi Chen is a Senior Product Manager at AWS specializing in Amazon Managed Grafana. She has been involved with Observability products at AWS to help customer enhance their experiences with open-source data visualization platforms. She enjoys helping customers build innovative products and services to simplify their day-to-day work experience. Her area of interests include cloud engineering, product management, system design, user experience and machine learning. Find her on LinkedIn: /mengdic.

Imaya Kumar Jagannathan

Imaya is a Principal Solution Architect focused on AWS Observability tools including Amazon CloudWatch, AWS X-Ray, Amazon Managed Service for Prometheus, Amazon Managed Grafana and AWS Distro for Open Telemetry. He is passionate about monitoring and observability and has a strong application development and architecture background. He likes working on distributed systems and is excited to talk about microservice architecture design. He loves programming on C#, working with containers and serverless technologies. LinkedIn: /imaya.