Security

Critical: restrict access to monitoring ports

Grafana (3000) and Prometheus (9090) must not be exposed publicly without authentication. Both interfaces can expose sensitive system metrics and configuration.

EC2 security group — recommended rules:

Port 22   — SSH, your IP only
Port 3000 — Grafana, your IP or VPN CIDR only
Port 9090 — Prometheus, your IP or VPN CIDR only
Port 9100 — Node Exporter, localhost only (do not open externally)

Grafana credentials

No admin password is pre-set — you are required to set one on first login
Use a strong, unique password
Create separate viewer accounts for team members who only need to read dashboards
Disable the admin account and create a named admin user for better audit trails

Prometheus access

Prometheus has no built-in authentication. Protect it by:

Keeping port 9090 closed to public traffic (security group rule)
Using an nginx reverse proxy with HTTP Basic Authentication if external access is needed
Enabling the --web.enable-admin-api flag only if required

HTTPS for Grafana

For production use, place Grafana behind an nginx reverse proxy with a TLS certificate:

server {
    listen 443 ssl;
    server_name grafana.yourdomain.com;

    ssl_certificate     /etc/ssl/certs/your-cert.pem;
    ssl_certificate_key /etc/ssl/private/your-key.pem;

    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
    }
}

Reporting security issues

Contact [email protected] for any security concerns.

Previous← configuration Nextfaq →