The 27 Grafana Cloud security checks Black Cat runs
Black Cat SSPM evaluates 27 security policies against your Grafana Cloud configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect Grafana Cloud — what access Black Cat needs, and why.
Access control & privilege
16 checks · highest severity: critical
Encryption, keys & secrets
8 checks · highest severity: critical
Access control & privilege (16)
- Excessive Cloud Admins severity: medium
- Cloud Wildcard Access Policy severity: critical
- Overly Permissive Access Policy severity: high
- Access Policy Without IP Restriction severity: medium
- Single Cloud Admin severity: high
- Access Policy With No Scopes severity: high
- Access Policy With No Realm Binding severity: medium
- Access Policy Combines Write and Delete Scopes severity: high
- Access Policy Uses Org-Wide Realm severity: medium
- Recently Added Admin Member severity: medium
- Write-Scoped Access Policy Without IP Restriction severity: high
- Organization Member Without Email severity: medium
- Excessive Scope Count on Access Policy severity: medium
- Token Bound to Unknown or Deleted Policy severity: high
- Token With Expiration Over 365 Days severity: medium
- Token Not Rotated in 180 Days severity: medium
Encryption, keys & secrets (8)
- Excessive Tokens Per Policy severity: medium
- Non-Expiring Cloud Token severity: high
- Dormant Cloud Token severity: medium
- Token With Wildcard Policy severity: critical
- Recently Created Token Without Use severity: low
- Orphaned Access Policy severity: low
- Token Never Used After 30 Days severity: medium
- Write-Capable Token Inactive for 30 Days severity: high
Other checks (3)
severity: medium Token Expiring Within 14 Days fix difficulty: easy #
Rotate the token before it expires to avoid service disruption
- Navigate to grafana.com/orgs/<org>/access-policies
- Locate the access policy associated with the expiring token
- Create a new token under the same access policy with an appropriate expiration
- Update the consuming service to use the new token
- Verify the service is functioning with the new token
- The old token will auto-expire on its expiration date
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: low Stale Access Policy Not Updated in 180 Days fix difficulty: easy #
Review the access policy to ensure its scopes and realms still match current requirements
- Navigate to grafana.com/orgs/<org>/access-policies
- Locate the policy that has not been updated in over 180 days
- Review its scopes and remove any that are no longer needed
- Verify realm bindings still match the intended stack targets
- If the policy is no longer needed, delete it and revoke associated tokens
- Update the policy description to reflect its current purpose
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: info Access Policy Without Display Name fix difficulty: easy #
Add a descriptive display name to the access policy for operational clarity
- Navigate to grafana.com/orgs/<org>/access-policies
- Locate the policy with no display name set
- Click Edit on the policy
- Enter a clear, descriptive display name reflecting the policy's purpose
- Save the policy
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC8.1 NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-28.4