data source configuration

9 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Google Cloud KMS encryption prerequisites

To encrypt database secrets using Google Cloud KMS, you need a Google Cloud account with permission to list and create KMS keys and service accounts to access those keys. You also need access to the Grafana configuration file.

Create Google Cloud KMS key for Grafana encryption

Create a key ring in Google Cloud KMS, then create a symmetric encryption key within that key ring. Create a service account and assign it a role with permissions to encrypt and decrypt secrets with Key Management Service. Create a service account key and save its JSON file to your computer, for example at ~/.config/gcloud/sample-project-credentials.json.

Google Cloud KMS grafana.ini configuration section format

Add a new section to the grafana.ini configuration file with the name format [security.encryption.googlekms.<KEY-NAME>], where <KEY-NAME> is any name that uniquely identifies this key among other provider keys.

Google Cloud KMS grafana.ini configuration parameters

In the [security.encryption.googlekms.<KEY-NAME>] section, configure: key_id (the encryption key ID as a string UUID), and credentials_file (the full path to the service account key JSON file on the computer).

Google Cloud KMS grafana.ini security section configuration

Update the [security] section of grafana.ini with three settings: secret_key (the previous encryption key used for legacy alerts and decrypting existing secrets), encryption_provider (in format <PROVIDER>.<KEY-NAME>, such as googlekms.example-encryption-key), and available_encryption_providers (space-separated list of configured key providers, such as googlekms.example-encryption-key).

Google Cloud KMS grafana.ini example configuration

Example Google Cloud KMS provider section in grafana.ini: ``` ;[security.encryption.googlekms.example-encryption-key] key_id = 1234abcd-12ab-34cd-56ef-1234567890ab credentials_file = ~/.config/gcloud/sample-project-credentials.json ``` Example [security] section: ``` [security] secret_key = AaaaAaaa encryption_provider = googlekms.example-encryption-key available_encryption_providers = googlekms.example-encryption-key ```

Enable envelope encryption in Grafana

Turn on envelope encryption from within Grafana before adding Google Cloud KMS details to the configuration file.

Re-encrypt secrets with new Google Cloud KMS key

After configuring Google Cloud KMS in grafana.ini and restarting Grafana, optionally re-encrypt all secrets in the Grafana database with the new key using the command: grafana cli admin secrets-migration re-encrypt. If you do not re-encrypt existing secrets, they remain encrypted by the previous encryption key and users can still access them. This process could take minutes depending on the number of secrets and users might experience errors while running; alert notifications might not be sent.

Skip secrets re-encryption for new Grafana installations

If updating the encryption key during initial Grafana setup before any data sources or dashboards have been created, the secrets-migration re-encrypt step is not necessary because there are no secrets to migrate.

Give your agent this brain