This is archived documentation for v2.1.x. Go to the latest version.
Securing Grafana Mimir Alertmanager
By default, the Alertmanager exposes API endpoints that enable a user to configure the Alertmanager.
The Alertmanager configuration includes receivers that create network connections to send the alerting notifications.
For example, the
webhook receiver enables a user to configure an arbitrary URL to which the Alertmanager sends a customizable request for every alerting notification.
If the Alertmanager network security is not hardened, Grafana Mimir users might configure the Alertmanager to issue requests to any network address both in the local network and the Internet.
We recommend hardening the network on which the Alertmanager runs. Although hardening the network is out of the scope for Grafana Mimir, Grafana Mimir provides a basic built-in firewall that blocks connections created by Alertmanager receivers:
- To block specific network addresses in Alertmanager receivers, set
-alertmanager.receivers-firewall-block-cidr-networksto a comma-separated list of network CIDRs to block.
- To block private and local addresses in Alertmanager receivers, set
You can override the Alertmanager built-in firewall settings on a per-tenant basis in the overrides section of the runtime configuration.
Note: You can disable the Alertmanager configuration API by setting
Related Mimir resources
How to control metrics growth in Prometheus and Kubernetes with Grafana Cloud
This webinar will introduce a metrics cost management framework to optimize metrics growth while keeping rising costs at bay with Grafana Cloud.
Intro to Grafana Mimir: The open source time series database that scales to 1 billion metrics & beyond
Grafana Mimir webinar—learn about our open source solution for extending Prometheus at organizations needing massive scale, rapid query performance.
For billion-series scale or home IoT projects, get started in minutes with Grafana Mimir
Learn how easy it is to get started with Mimir, no matter how many or few time series you need to store.