grafana v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-grafana-service-account-token

Custody

customer_vault

Injection

header (Authorization)

A Grafana service account token for the customer's own instance, held in the client's own secret manager. The stored material must be the complete Authorization header value: the scheme 'Bearer', one separating space, then the token — 'Bearer <token>'. Use a dedicated service account with the least-privilege role this read-only pack needs — never a personal user's credentials, and never the legacy admin API key form. Viewer alone is not sufficient for the complete pack: Grafana documents the org-users endpoint as requiring the org admin role under basic roles, and the alert-provisioning reads as gated by their own RBAC permissions, so the service account needs a fixed role (Grafana RBAC, available in Grafana Enterprise and Grafana Cloud) granting exactly the read permissions for these four operations — dashboards:read, datasources:read, org.users:read and alert.provisioning:read — and nothing broader. Where RBAC is unavailable, a read-only deployment cannot reach the org-users endpoint at all and must remove grafana.users.read from its copy rather than grant org admin. Grafana's token value is shown once at creation, so capture it into the vault at creation time. Tokens default to never expiring (the creation API's secondsToLive defaults to 0): set an explicit expiry and rotate — renewal ownership sits with an external deployment process, and the executor injects the stored value verbatim and performs no token lifecycle of its own. Revocation is deleting the token (DELETE /api/serviceaccounts/:id/tokens/:tokenId), disabling or deleting the service account; do not assume that restricting new token issuance invalidates tokens already issued — delete the issued token itself. Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

• grafana-instance (api, internal): https://grafana-instance.invalid/api
• grafana-org-users (api, pii): https://grafana-instance.invalid/api/org/users

The endpoint host 'grafana-instance.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the customer's own Grafana host — an on-prem instance host or a Grafana Cloud stack host (<stack>.grafana.net) — in the endpoints, the resource locators and the egress allowlist before enabling; the allowlist matches exactly, so all three must be substituted together, substitution is a required deployment step, and allowlisting the reserved host does not make an unsubstituted pack safe (the reserved name is a deliberate fail-closed default: it resolves nowhere by design, so an unsubstituted pack cannot call anything until the installer binds the real host). Every read endpoint here is a COLLECTION read only: single-record reads (GET /api/dashboards/uid/:uid, GET /api/datasources/uid/:uid, GET /api/v1/provisioning/alert-rules/:uid) are not registered. Dashboard search (GET /api/search) returns the dashboards and folders the token's service account may see, so the result set itself is authorization-scoped by Grafana. This pack is read-only. Documented exclusions — this pack does not register: dashboard creation, update or deletion (POST /api/dashboards/db, DELETE /api/dashboards/uid/:uid and the dashboard.grafana.app API group), data source creation, update, deletion or queries (POST /api/ds/query — caller-controlled query text against every configured data source cannot be pinned by a pack, the same rule as the postgres pack's query capabilities, and this pack supplies no reviewed adapter to constrain it), user or team administration, alert rule provisioning writes (POST/PUT/DELETE on /api/v1/provisioning/alert-rules — writing alert rules can create or silence the alerts that wake people, an effect-level risk this pack does not register), silences (the Alertmanager silences API — creating a silence suppresses alert notifications and can hide incidents from responders, an effect this pack does not register), service account administration, and the legacy /api/alerts endpoint — a documented exclusion, not an approximated capability.

Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://grafana.com/docs/grafana/latest/developers/http_api/folder_dashboard_search/ (retrieved 2026-09-21)
• https://grafana.com/docs/grafana/latest/developers/http_api/dashboard/ (retrieved 2026-09-21)
• https://grafana.com/docs/grafana/latest/developers/http_api/data_source/ (retrieved 2026-09-21)
• https://grafana.com/docs/grafana/latest/developers/http_api/org/ (retrieved 2026-09-21)
• https://grafana.com/docs/grafana/latest/developers/http_api/alerting_provisioning/ (retrieved 2026-09-21)
• https://grafana.com/docs/grafana/latest/developers/http_api/serviceaccount/ (retrieved 2026-09-21)

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.