Skip to content

Grafana Cloud access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Grafana Cloud, Black Cat runs 16 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Grafana Cloud connector needs.

Checks (16)

severity: medium Excessive Cloud Admins fix difficulty: easy #

Reduce the number of Cloud organization admins to the minimum required

  1. Navigate to grafana.com and sign in with an org admin account
  2. Go to your organization page at grafana.com/orgs/<org>/members
  3. Review the list of members with the Admin role
  4. Identify admins who no longer require elevated access
  5. Click the role dropdown next to each excess admin and downgrade to Viewer or Editor
  6. Confirm the change and notify affected users

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical Cloud Wildcard Access Policy fix difficulty: medium #

Remove wildcard scopes from the Cloud Access Policy and replace with least-privilege scopes

  1. Navigate to grafana.com/orgs/<org>/access-policies
  2. Locate the access policy containing wildcard scopes
  3. Click Edit on the policy
  4. Remove any wildcard scope entries (e.g. metrics:*, logs:*, traces:*)
  5. Add only the specific scopes required for the use case (e.g. metrics:read)
  6. Save the policy and rotate any tokens issued under it

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Overly Permissive Access Policy fix difficulty: medium #

Restrict write and delete scopes or limit the policy realm to specific stacks

  1. Navigate to grafana.com/orgs/<org>/access-policies
  2. Locate the overly permissive access policy
  3. Click Edit on the policy
  4. Remove write and delete scopes that are not explicitly required
  5. Under Realms, restrict the policy to specific stacks instead of the full org
  6. Save the updated policy and rotate any associated tokens

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Access Policy Without IP Restriction fix difficulty: easy #

Add an IP allowlist restriction to the Cloud Access Policy

  1. Navigate to grafana.com/orgs/<org>/access-policies
  2. Locate the access policy missing IP restrictions
  3. Click Edit on the policy
  4. Scroll to the IP allowlist section
  5. Add the CIDR ranges or individual IP addresses that should be permitted
  6. Save the policy; tokens issued under it will now be restricted to allowed IPs

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Single Cloud Admin fix difficulty: easy #

Add a second admin to the Grafana Cloud organization to eliminate the single point of failure

  1. Navigate to grafana.com/orgs/<org>/members
  2. Identify a trusted senior team member to promote to admin
  3. Click the role dropdown next to that member and select Admin
  4. Confirm the promotion and document the change for audit purposes
  5. Notify both admins of their shared responsibility

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Access Policy With No Scopes fix difficulty: easy #

Add explicit scopes to the access policy or delete it if unused

  1. Navigate to grafana.com/orgs/<org>/access-policies
  2. Locate the policy with no scopes configured
  3. Determine whether the policy is actively used or abandoned
  4. If abandoned, delete the policy and revoke any associated tokens
  5. If still needed, click Edit and add the minimum required scopes (e.g. metrics:read)
  6. Save the policy and verify downstream services are unaffected

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Access Policy With No Realm Binding fix difficulty: easy #

Add at least one realm binding to the access policy or delete it if unused

  1. Navigate to grafana.com/orgs/<org>/access-policies
  2. Locate the policy with no realm bindings
  3. Click Edit and scroll to the Realms section
  4. Add the specific stack or org realm this policy should govern
  5. Prefer stack-level realms over org-wide realms to limit blast radius
  6. Save the policy and verify tokens issued under it work as expected

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Access Policy Combines Write and Delete Scopes fix difficulty: medium #

Split the policy into separate write and delete policies following least-privilege principle

  1. Navigate to grafana.com/orgs/<org>/access-policies
  2. Locate the policy combining write and delete scopes
  3. Create a new policy with only the write scopes needed
  4. Create a second separate policy with only the delete scopes if required
  5. Issue new tokens under each dedicated policy and update consuming services
  6. Revoke the original combined policy and its tokens

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Access Policy Uses Org-Wide Realm fix difficulty: medium #

Replace the org-wide realm with stack-specific realms to limit the policy's blast radius

  1. Navigate to grafana.com/orgs/<org>/access-policies
  2. Locate the policy with an org-wide realm binding
  3. Click Edit and navigate to the Realms section
  4. Remove the org realm and add the specific stack realms that require access
  5. Save the updated policy and verify that tokens under it still function correctly
  6. Document the stacks covered by each policy for future reference

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Recently Added Admin Member fix difficulty: easy #

Review the recently promoted admin account to confirm the elevation was authorized

  1. Navigate to grafana.com/orgs/<org>/members
  2. Locate the admin account that was added within the last 7 days
  3. Verify the promotion was requested through your access-management process
  4. Confirm the account belongs to an active employee or contractor
  5. If the promotion was unauthorized, immediately downgrade the role to Viewer or Editor
  6. File an incident report if privilege escalation is suspected

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Write-Scoped Access Policy Without IP Restriction fix difficulty: easy #

Add an IP allowlist to access policies that carry write or delete scopes

  1. Navigate to grafana.com/orgs/<org>/access-policies
  2. Locate the access policy with write or delete scopes but no IP restriction
  3. Click Edit and scroll to the IP allowlist section
  4. Add the CIDR ranges of systems authorized to use this policy's tokens
  5. Save the policy; existing tokens will immediately be subject to the IP restriction
  6. Verify that authorized services can still authenticate after the restriction is applied

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Organization Member Without Email fix difficulty: easy #

Add an email address to the organization member account for identification and notifications

  1. Navigate to grafana.com/orgs/<org>/members
  2. Locate the member account with no email address
  3. Ask the member to update their Grafana account profile with a valid email
  4. If the account is a service or bot account, document its purpose and owner
  5. If the account is abandoned, remove it from the organization

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Excessive Scope Count on Access Policy fix difficulty: medium #

Reduce the number of scopes on the access policy by splitting into multiple purpose-specific policies

  1. Navigate to grafana.com/orgs/<org>/access-policies
  2. Locate the access policy with excessive scopes
  3. Identify distinct use cases covered by the policy scopes
  4. Create separate access policies for each use case with only the required scopes
  5. Issue new tokens under each dedicated policy and update consuming services
  6. Revoke the original over-scoped policy and its tokens

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Token Bound to Unknown or Deleted Policy fix difficulty: medium #

Revoke the orphaned token and create a replacement under a valid access policy

  1. Navigate to grafana.com/orgs/<org>/access-policies
  2. Search for the token name across all access policies
  3. If the parent policy was deleted, revoke the orphaned token immediately
  4. Determine whether the token is still in use by any service
  5. If still needed, create a new token under an appropriate access policy
  6. Update the consuming service with the new token

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Token With Expiration Over 365 Days fix difficulty: easy #

Reduce the token expiration to 365 days or less and establish a rotation schedule

  1. Navigate to grafana.com/orgs/<org>/access-policies
  2. Locate the access policy associated with the long-lived token
  3. Revoke the existing token with excessive expiration
  4. Create a replacement token with a shorter expiration (90-180 days recommended)
  5. Update the consuming service with the new token
  6. Set a calendar reminder to rotate the token before its new expiration

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Token Not Rotated in 180 Days fix difficulty: easy #

Rotate the token by creating a replacement and revoking the old one

  1. Navigate to grafana.com/orgs/<org>/access-policies
  2. Locate the access policy associated with the aging token
  3. Create a new token under the same access policy
  4. Update the consuming service to use the new token
  5. Verify service functionality with the new token
  6. Revoke the old token after confirming the switch

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More Grafana Cloud checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial