Grafana Cloud IP ranges

Official Grafana Cloud ranges from the vendor's publication, split by purpose: alerts, logs, metrics. The ranges below render live from the signed slash0 feed.

purpose	direction	IPv4	IPv6
`grafana-cloud/alerts`	ingress	·	·
`grafana-cloud/logs`	ingress	·	·
`grafana-cloud/metrics`	ingress	·	·

grafana-cloud/alerts

Direction: ingress. Ranges Grafana Cloud connects from (webhook delivery); use them in security group ingress rules on your receiving endpoints.

loading ranges from the feed…

Terraform

data "ipranges_ingress" "grafana_cloud_alerts" {
  service = "grafana-cloud"
  purpose = "alerts"
}

resource "aws_security_group_rule" "grafana_cloud_alerts" {
  type              = "ingress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_ingress.grafana_cloud_alerts.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

grafana-cloud/logs

Direction: ingress. Ranges Grafana Cloud connects from (webhook delivery); use them in security group ingress rules on your receiving endpoints.

loading ranges from the feed…

Terraform

data "ipranges_ingress" "grafana_cloud_logs" {
  service = "grafana-cloud"
  purpose = "logs"
}

resource "aws_security_group_rule" "grafana_cloud_logs" {
  type              = "ingress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_ingress.grafana_cloud_logs.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

grafana-cloud/metrics

Direction: ingress. Ranges Grafana Cloud connects from (webhook delivery); use them in security group ingress rules on your receiving endpoints.

loading ranges from the feed…

Terraform

data "ipranges_ingress" "grafana_cloud_metrics" {
  service = "grafana-cloud"
  purpose = "metrics"
}

resource "aws_security_group_rule" "grafana_cloud_metrics" {
  type              = "ingress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_ingress.grafana_cloud_metrics.ipv4_cidrs
  security_group_id = aws_security_group.app.id
}

keep rules current automatically

Terraform data sources refresh only when you run an apply. The hosted tier publishes the same data via AWS managed prefix lists (slash0.grafana-cloud.alerts.v4 and so on), shared into your account via AWS RAM: rules reference one pl-… id and update within a minute of a vendor change, with removals held through a 72 hour grace window. Request early access or read how it works.

provenance

Ranges come from Grafana Cloud's official publication: https://grafana.com/docs/grafana-cloud/security-and-account-management/allow-list/. Fetched sources:

Every publish is signed (ECDSA P-256 over the feed index, each service document hash-chained to it) and every range change is recorded in the changelog. Verification steps: security. Provider setup: quickstart.