Grafana Cloud encryption, keys & secrets security checks
Encryption at rest and in transit, key rotation, and the API keys, tokens and credentials that outlive the people who created them.
On Grafana Cloud, Black Cat runs 8 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Grafana Cloud connector needs.
Checks (8)
severity: medium Excessive Tokens Per Policy fix difficulty: medium #
Reduce token count per access policy by revoking unused tokens and splitting policies by use case
- Navigate to grafana.com/orgs/<org>/access-policies
- Select the access policy with excessive tokens
- Review each token in the Tokens list and identify unused or redundant ones
- Revoke tokens that are no longer needed
- For distinct use cases sharing one policy, create separate access policies with dedicated tokens
- Update consuming services to use the new tokens and confirm functionality
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.ii HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8
severity: high Non-Expiring Cloud Token fix difficulty: easy #
Set an expiration date on the Grafana Cloud access policy token
- Navigate to grafana.com/orgs/<org>/access-policies
- Locate the access policy that issued the non-expiring token
- In the Tokens list, find the token without an expiration date
- Revoke the existing token
- Create a replacement token with an explicit expiration date (e.g. 90 days)
- Update all services using the old token with the new token value
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.ii HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8
severity: medium Dormant Cloud Token fix difficulty: easy #
Revoke or rotate Grafana Cloud tokens that have not been used in over 90 days
- Navigate to grafana.com/orgs/<org>/access-policies
- Select the access policy associated with the dormant token
- Review the token list and identify tokens with no recent activity
- Revoke the dormant token
- If the token is still required, create a new token and update the consuming service
- Confirm the service is functioning before closing
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.ii HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8
severity: critical Token With Wildcard Policy fix difficulty: medium #
Reassign the token to a non-wildcard access policy with least-privilege scopes
- Navigate to grafana.com/orgs/<org>/access-policies
- Create a new access policy with only the specific scopes required by the consuming service
- Issue a new token under this least-privilege policy
- Update the consuming service to use the new token
- Revoke the old token that was bound to the wildcard policy
- Optionally delete the wildcard policy if no other tokens require it
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.ii HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8
severity: low Recently Created Token Without Use fix difficulty: easy #
Revoke newly created tokens that have never been used to eliminate orphaned credentials
- Navigate to grafana.com/orgs/<org>/access-policies
- Select the access policy associated with the unused token
- Locate the token with no recorded usage since creation
- Verify with the token owner whether the token is still needed
- If unneeded or abandoned, revoke the token immediately
- Document the reason for revocation for audit trail purposes
Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.ii HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8
severity: low Orphaned Access Policy fix difficulty: easy #
Delete the orphaned access policy or create a token under it if it is still needed
- Navigate to grafana.com/orgs/<org>/access-policies
- Locate the policy with zero linked tokens
- Confirm with the policy owner whether it is still required
- If no longer needed, delete the policy to reduce the attack surface
- If still required, issue a token and assign it to the appropriate service
- Document the outcome for audit trail purposes
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8
severity: medium Token Never Used After 30 Days fix difficulty: easy #
Revoke tokens that were created over 30 days ago and have never been used
- Navigate to grafana.com/orgs/<org>/access-policies
- Select the access policy associated with the unused token
- Locate the token with no recorded first-use date
- Verify with the token owner whether it has been deployed
- If undeployed or abandoned, revoke the token immediately
- If still needed, confirm the consuming service received it and retest
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8
severity: high Write-Capable Token Inactive for 30 Days fix difficulty: easy #
Revoke inactive write or delete capable tokens to prevent credential abuse
- Navigate to grafana.com/orgs/<org>/access-policies
- Locate the access policy containing the inactive token
- Review the token last-used date to confirm inactivity
- Revoke the inactive token
- If the token is still required by a service, create a replacement and update the service
- Investigate why the service stopped using the token and document findings
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.8