Documentationbreadcrumb arrow Grafana Cloudbreadcrumb arrow Security and account managementbreadcrumb arrow List of source IPs to add to your allowlist
Grafana Cloud

List of source IPs to add to your allowlist

If your network requires external services to be on an allowlist (formerly called a whitelist) to allow access, you can use the following lists to update your ACLs.

Note

These lists can change. To stay up-to-date and receive notifications for changes to these lists, subscribe to the Grafana status page.

Hosted Alerts

Hosted Alerts publishes lists of up-to-date IP addresses that can be used for allowlisting:

Note

Instead of using these global lists, individual DNS lookup records are also available for each Hosted Alerts instance.

These records can be found in your Grafana Cloud stack details on the Alerts instance details page, in the Allowing IPs for this cluster section.

Hosted Alerts are generated by data source-managed alert rules. These rules are evaluated within the data source itself, rather than by the Grafana instance. The resulting alerts are forwarded to a hosted Alertmanager instance, which then triggers the alert notifications.

To receive Grafana-managed alerts—alerts that are evaluated within Grafana and triggered by its built-in Alertmanager—enable access to the Hosted Grafana lists.

Hosted Grafana

Hosted Grafana publishes similar lists of up-to-date IP addresses that can be used for allowlisting:

Hosted Metrics

Hosted Metrics publishes similar lists of up-to-date IP addresses that can be used for allowlisting:

Note

Instead of using these global lists, individual DNS lookup records are also available for each Hosted Metrics instance.

These records can be found in your Grafana Cloud stack details on the Prometheus or Graphite instance details page, in the Allowing IPs for this cluster section.

Hosted Traces

Hosted Traces publishes similar lists of up-to-date IP addresses that can be used for allow-listing:

Note

Instead of using these global lists, individual DNS lookup records are also available for each Hosted Traces instance.

These records can be found in your Grafana Cloud stack details on the Tempo instance details page, in the Allowing IPs for this cluster section.

Hosted Logs

Hosted Logs publishes similar lists of up-to-date IP addresses that can be used for allowlisting:

Note

Instead of using these global lists, individual DNS lookup records are also available for each Hosted Logs instance.

These records can be found in your Grafana Cloud stack details on the Loki instance details page, in the Allowing IPs for this cluster section.

Hosted Profiles

Hosted Profiles publishes similar lists of up-to-date IP addresses that can be used for allowlisting:

Note

Instead of using these global lists, individual DNS lookup records are also available for each Hosted Profiles instance.

These records can be found in your Grafana Cloud stack details on the Pyroscope instance details page, in the Allowing IPs for this cluster section.

OTLP Gateway

Grafana Cloud OTLP Gateway publishes similar lists of up-to-date IP addresses that can be used for allowlisting:

Synthetic Monitoring

Synthetic Monitoring publishes a list of up-to-date CIDR ranges that can be used for allowlisting:

DNS records

Warning

DNS records for Synthetic Monitoring probes have been removed. They are no longer deployed, enhanced, or supported.

Private data source connect (PDC)

The PDC agent requires outbound access to two cluster-specific endpoints. Replace <CLUSTER> with your Grafana Cloud cluster value, which you can find in the Grafana UI under Connections > Private data source connections > Configuration Details.

The endpoint format depends on your cluster. Newer clusters and BYOC clusters use a regional format with a . (dot) separator, while older clusters use a flat format with a - (dash) separator:

EndpointRegional format (newer clusters)Flat format (older clusters)
SSH tunnel (port 22)private-datasource-connect.<CLUSTER>.grafana.net:22private-datasource-connect-<CLUSTER>.grafana.net:22
Certificate signing API (port 443)private-datasource-connect-api.<CLUSTER>.grafana.net:443private-datasource-connect-api-<CLUSTER>.grafana.net:443

The exact hostnames for your cluster appear in the Grafana UI under Connections > Private data source connections > Configuration Details.

Note

PDC endpoints are DNS-based and cluster-specific, so there is no global IP list. If your firewall doesn’t support DNS-based rules, you can resolve the current IPs with dig or nslookup, but these IPs can change. Use DNS names where possible.

For full setup instructions, refer to Configure private data source connect (PDC).

Grafana Assistant

Grafana Assistant publishes similar lists of up-to-date IP addresses that can be used for allowlisting: