Grafana secrets encryption and key management
How Grafana protects data source passwords and tokens in its database: envelope encryption, protecting secret_key, KMS options in Enterprise, re-encrypting after a key change and rotating data keys.
Grafana security
Specific security controls for self-hosted Grafana beyond baseline hardening: secrets encryption, plugin trust, audit trails, patching and sharing exposure.
Grafana plugin signatures and unsigned plugin risk
Deciding which plugins to trust: signature levels and statuses, why unsigned plugins do not load, the risk of allow_loading_unsigned_plugins, and a review process for community plugins.
Grafana audit logs for access and change tracking
What Grafana audit logging records, the Enterprise requirement, sending audit events to Loki or files, and how teams on the open-source edition reconstruct changes from server logs and dashboard versions instead.
Grafana vulnerability management and security patching
Keeping Grafana patched: following Grafana Labs security advisories, patch release cadence, supported minor versions, plugin updates and a tested path to apply fixes quickly.
Limiting data exposure from Grafana snapshots and shared dashboards
Reducing what leaves Grafana through sharing features: external snapshot publishing, externally shared dashboards and their annotation behaviour, anonymous access and the settings that turn them off.
Grafana penetration testing and security assessment
Scoping a security test of a self-hosted Grafana: authentication and role mapping, data source proxying, plugins, sharing features, the hardening settings a tester will check, and retesting after fixes.
