Grafana viewers can reach more data than a dashboard shows
Grafana uses data source connections to query databases, logs, metrics, and APIs. The data source proxy lets Grafana send requests to those services on behalf of a user or service account. That is convenient for dashboards, but it also means dashboard visibility and data source authority are different questions.
The Grafana security documentation warns that a Viewer can enter queries against any data source available in the organization, not only the queries saved in dashboards the Viewer can open. A dashboard that hides a sensitive field in a panel does not necessarily prevent a Viewer from issuing another query through Explore or a crafted request. The backend data source credentials determine what Grafana can ask, and the data source permission model determines who can use that connection.
Inventory the proxy paths
Every data source has a URL, proxy setting, authentication method, and set of allowed users or teams. Make an inventory of those connections and the network routes they can reach. A data source proxy that can reach an internal metadata service, an administrative API, or a shared database is a high-value path. The fact that the URL is configured in Grafana does not make it safe for every Viewer.
Restrict outbound destinations at the Grafana host and network layer. Grafana documents options for limiting data source URLs and proxied hosts. Use a denied list for cloud metadata endpoints, loopback services, and administrative networks that no dashboard needs. Prefer a dedicated proxy or egress gateway for external data sources. Log the destination, response status, and user identity where the deployment supports it.
Separate data sources by trust boundary. A production finance database, a development metrics store, and a shared log cluster should not all be reachable through one broadly granted connection. Give each data source its own service identity with the minimum database or API permissions it needs. If a data source supports read-only credentials, use them.
Control query authority
Data source permissions can restrict who can query, edit, or administer a connection. Grafana Cloud and Grafana Enterprise expose a permission model that can be assigned to users, teams, or roles. In self-managed deployments, role design and the version's feature set determine which controls are available. Check the installed edition rather than assuming a dashboard permission is enough.
Labels and attribute-based access can add another layer, but they must be mapped to a policy that is testable. A team label on a user should not become a blanket grant to every data source with a similar label. Verify the effective query path with a user who has only Viewer access. Try a query outside the dashboard, a different time range, and a direct API call against the data source proxy.
Do not store high privilege database credentials in a shared data source when a more limited forwarding identity can do the job. If users must query a shared database, enforce tenant or row restrictions in the database role used by the data source. Grafana-side visibility is not a substitute for database authorization.
Review dashboards as code
A dashboard's JSON can contain queries, URLs, and variables. Review changes in version control and look for queries that target unexpected tables or services. A dashboard variable can allow a user to influence a query in ways the author did not intend. Parameterize only through supported template variables and validate the server-side data source policy.
Run Grafana with a service account that has a small network role. Use TLS for data source connections and validate the destination certificate. If a data source uses a custom certificate authority, scope that trust to the intended connection. Do not disable hostname verification to make a dashboard work.
Test the failure cases. Remove a user's data source permission and confirm that both the dashboard and an Explore query fail. Change the proxy allowlist and confirm that a blocked destination cannot be reached through a crafted URL. Inspect Grafana and egress logs for the request that was attempted, not only the response code.
Grafana is a query client as well as a presentation layer. Treat each data source as an API connection with its own identity, network path, and authorization policy. That model aligns dashboard access, service credentials, and the actual data permissions that determine what a Viewer can retrieve.
Top comments (0)