Grafana
Connect a Grafana Cloud stack to Ploy to see who has access to it, what organization role each person holds, which teams they belong to and which service accounts exist. Ploy can also invite people, change their role, remove them and manage team membership.
This integration is in beta
The Grafana integration is in beta. It was built from Grafana's API documentation and has not yet been run against a live customer stack, so some behaviour may change as we confirm it.
The first step of setup is a consent checkbox. Ticking it lets Ploy record redacted error details when a call to Grafana fails, so we can fix problems quickly. Redacted means names, email addresses, tokens and other personal or secret values are removed before anything is stored. You must tick it to continue.
What Ploy reads
Users: everyone in the stack, with their email address, organization role (Viewer, Editor or Admin) and when they were last seen. Disabled users are shown as blocked and lose their access in Ploy straight away.
Service accounts: every service account, with its role.
Teams: every team and its members.
Ploy connects one stack per connection. If you have several stacks, add a connection for each one.
What Ploy can change
Invite a user to the stack by email, with a Viewer role unless you choose another. Grafana Cloud only accepts an invitation for someone who already has a Grafana account, unless your stack allows basic sign-in or the person signs in through single sign-on first.
Change a user's role between Viewer, Editor and Admin.
Remove a user from the stack. Their Grafana account and any other stacks are not affected.
Add or remove team members from a team's resource page.
If single sign-on controls a user's role, Grafana refuses role changes and removals for that user. Change them in your identity provider instead.
Before you start
You need to be an Admin of the Grafana Cloud stack, and you need the stack's address, for example https://yourcompany.grafana.net. Custom domains are not supported yet.
Create a service account and token
In Grafana, open Administration, then Users and access, then Service accounts.
Click Add service account, give it a name such as Ploy, and choose the Admin role. Ploy needs Admin to read users and teams and to make changes.
Open the new service account and click Add service account token.
Choose an expiry that suits you, generate the token and copy it. You will not be able to see it again.
Connect Grafana in Ploy
In Ploy, go to Integrations and choose Grafana.
Tick the beta consent checkbox.
Enter your Grafana Cloud stack URL, for example https://yourcompany.grafana.net.
Paste the service account token.
Click Test connection, then save.
Ploy runs its first scan straight away. Users refresh every hour; teams and service accounts every six hours.
Troubleshooting
Grafana rejected the token: the token was not copied in full or has expired. Create a new token and update the connection.
The service account cannot read the stack's users: give the service account the Admin role.
Enter your Grafana Cloud stack URL: the address must look like https://yourcompany.grafana.net.