---
title: "Vault integration | Grafana Cloud documentation"
description: "Learn about Vault Grafana Cloud integration."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Vault integration for Grafana Cloud

HashiCorp Vault secures, stores, and controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. This integration allows you to monitor metrics from Vault.

This integration includes 1 pre-built dashboard to help monitor and visualize Vault metrics.

## Before you begin

To enable the Prometheus metrics endpoint, you need to [activate it](https://developer.hashicorp.com/vault/tutorials/monitoring/monitor-telemetry-grafana-prometheus?in=vault%2Fmonitoring) in your Vault node.

To do so, add the following snippet to your node configuration file.

JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```json
telemetry {
  disable_hostname = true
  prometheus_retention_time = "12h"
}
```

It is also necessary to issue an auth token for Prometheus to scrape the metrics endpoint, which is protected. For further guidance, refer to the official Vault documentation provided in this section.

## Install Vault integration for Grafana Cloud

1. In your Grafana Cloud stack, click **Connections** in the left-hand menu.
2. Find **Vault** and click its tile to open the integration.
3. Review the prerequisites in the **Configuration Details** tab and set up Grafana Alloy to send Vault metrics to your Grafana Cloud instance.
4. Click **Install** to add this integration’s pre-built dashboard to your Grafana Cloud instance, and you can start monitoring your Vault setup.

## Configuration snippets for Grafana Alloy

### Simple mode

These snippets are configured to scrape a single Vault instance running locally with default ports.

First, **manually** copy and append the following snippets into your alloy configuration file.

### Metrics snippets

Alloy ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```alloy
discovery.relabel "metrics_integrations_integrations_vault" {
	targets = [{
		__address__ = "localhost:8200",
	}]

	rule {
		target_label = "instance"
		replacement  = constants.hostname
	}
}

prometheus.scrape "metrics_integrations_integrations_vault" {
	targets    = discovery.relabel.metrics_integrations_integrations_vault.output
	forward_to = [prometheus.remote_write.metrics_service.receiver]
	job_name   = "integrations/vault"
	params     = {
		format = ["prometheus"],
	}
	metrics_path = "/v1/sys/metrics"

	authorization {
		type             = "Bearer"
		credentials_file = "/etc/prometheus/prometheus-token"
	}
}
```

### Advanced mode

The following snippets provide examples to guide you through the configuration process.

To instruct Grafana Alloy to scrape your Vault instances, **manually** copy and append the snippets to your alloy configuration file, then follow subsequent instructions.

### Advanced metrics snippets

Alloy ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```alloy
discovery.relabel "metrics_integrations_integrations_vault" {
	targets = [{
		__address__ = "localhost:8200",
	}]

	rule {
		target_label = "instance"
		replacement  = constants.hostname
	}
}

prometheus.scrape "metrics_integrations_integrations_vault" {
	targets    = discovery.relabel.metrics_integrations_integrations_vault.output
	forward_to = [prometheus.remote_write.metrics_service.receiver]
	job_name   = "integrations/vault"
	params     = {
		format = ["prometheus"],
	}
	metrics_path = "/v1/sys/metrics"

	authorization {
		type             = "Bearer"
		credentials_file = "/etc/prometheus/prometheus-token"
	}
}
```

To monitor your Vault instance, you must use a [discovery.relabel](/docs/alloy/latest/reference/components/discovery.relabel/) component to discover your Vault Prometheus endpoint and apply appropriate labels, followed by a [prometheus.scrape](/docs/alloy/latest/reference/components/prometheus.scrape) component to scrape it.

Configure the following properties within each `discovery.relabel` component:

- `__address__`: The address to your Vault Prometheus metrics endpoint.
- `instance` label: `constants.hostname` sets the `instance` label to your Grafana Alloy server hostname. If that is not suitable, change it to a value uniquely identifies this Vault instance.

If you have multiple Vault servers to scrape, configure one `discovery.relabel` for each and scrape them by including each under `targets` within the `prometheus.scrape` component.

## Dashboards

The Vault integration installs the following dashboards in your Grafana Cloud instance to help monitor your system.

- Hashicorp Vault

**Vault overview**

## Metrics

The most important metrics provided by the Vault integration, which are used on the pre-built dashboard, are as follows:

- up
- vault\_audit\_log\_request\_count
- vault\_audit\_log\_request\_failure
- vault\_audit\_log\_response\_count
- vault\_audit\_log\_response\_failure
- vault\_consul\_delete\_count
- vault\_consul\_get\_count
- vault\_consul\_list\_count
- vault\_consul\_put\_count
- vault\_core\_active
- vault\_core\_handle\_request\_count
- vault\_core\_unsealed
- vault\_expire\_num\_leases
- vault\_identity\_entity\_alias\_count
- vault\_identity\_num\_entities
- vault\_policy\_get\_policy\_count
- vault\_policy\_set\_policy\_count
- vault\_runtime\_alloc\_bytes
- vault\_runtime\_heap\_objects
- vault\_runtime\_malloc\_count
- vault\_runtime\_num\_goroutines
- vault\_secret\_kv\_count
- vault\_token\_count
- vault\_token\_count\_by\_auth
- vault\_token\_count\_by\_policy
- vault\_token\_count\_by\_ttl
- vault\_token\_create\_count
- vault\_token\_creation
- vault\_token\_lookup\_count
- vault\_token\_store\_count

## Changelog

md ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```md
# 1.0.0 - December 2025

* Chore: Fix incorrect semver to 1.0.0. No further changes

# 0.0.4 - September 2023

* New Filter Metrics option for configuring the Grafana Agent, which saves on metrics cost by dropping any metric not used by this integration. Beware that anything custom built using metrics that are not on the snippet will stop working.
* New hostname relabel option, which applies the instance name you write on the text box to the Grafana Agent configuration snippets, making it easier and less error prone to configure this mandatory label.

# 0.0.3 - December 2022

* Change panels to timeseries
* Change old bar charts to new bar gauges
* Add job, instance selectors
* Fix secrets table, add gauge to the table

# 0.0.2 - October 2022

* Updating mixin with the latest piechart panel

# 0.0.1 - October 2021

* Initial release
```

## Cost

By connecting your Vault instance to Grafana Cloud, you might incur charges. To view information on the number of active series that your Grafana Cloud account uses for metrics included in each Cloud tier, see [Active series and dpm usage](/docs/grafana-cloud/fundamentals/active-series-and-dpm/) and [Cloud tier pricing](/products/cloud/pricing/).