{
 "slug": "grafana",
 "name": "Grafana + Prometheus",
 "tagline": "Dashboards and alerting with a pre-wired Prometheus metrics backend",
 "category": "observability",
 "use_cases": [
  "dashboards",
  "metrics",
  "alerting"
 ],
 "aliases": [
  "prometheus",
  "grafana prometheus"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Grafana Labs",
  "url": "https://grafana.com/oss/grafana/",
  "license": "AGPL-3.0-only",
  "license_url": "https://github.com/grafana/grafana/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "13.2.4",
   "last_build": "2026-10-23",
   "entity_id": "prod-uzalxhg6vxugi",
   "ami_alias": "/aws/service/marketplace/prod-uzalxhg6vxugi/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-7zd4ykqydtcw6",
   "recommended_instance_type": "m6i.xlarge",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "13.2.3",
   "last_build": "2026-10-02",
   "offer_id": "grafana",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:grafana:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.grafana?tab=Overview",
   "recommended_vm_size": "Standard_D4s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/grafana/",
  "json": "https://lynxroute.com/products/grafana/product.json"
 },
 "release_notes": [
  {
   "version": "13.2.4",
   "title": "Grafana 13.2.4 + Prometheus 3.14.0",
   "notes": "* Grafana OSS updated 13.2.3 -> 13.2.4, a security release. AGPL-3.0 unchanged\n* Security: CVE-2026-15577, CVE-2026-33374, CVE-2026-93294 and CVE-2026-95502; alerting now strips sensitive headers on cross-host OAuth2 redirects\n* Prometheus remains at 3.14.0\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "13.2.3",
   "title": "Grafana 13.2.3 + Prometheus 3.14.0",
   "notes": "* Grafana OSS updated 13.2.2 -> 13.2.3, a security patch release. Prometheus remains at 3.14.0\n* Security: fixes for CVE-2026-13719, CVE-2026-13720 and CVE-2026-81841\n* Backend plugins keep working on long-running servers - plugin sockets now live under /run/grafana, out of reach of the periodic temporary-file cleanup\n* Image previews now work under the default content security policy, plus updated bundled dependencies\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-02"
   }
  },
  {
   "version": "13.2.2",
   "title": "Grafana 13.2.2 + Prometheus 3.14.0",
   "notes": "* Grafana OSS updated 13.2.1 -> 13.2.2, a patch release. Prometheus remains at 3.14.0\n* Security: fixes for CVE-2026-15815, CVE-2026-76154 and CVE-2026-79656\n* Preserves the query variable refresh setting on v2 dashboard import, and fixes a folder UID collision when a folder is renamed during a full provisioning sync\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-16",
    "azure": "2026-09-17"
   }
  },
  {
   "version": "13.2.1",
   "title": "Grafana 13.2.1 + Prometheus 3.14.0",
   "notes": "* Grafana OSS updated 13.2.0 -> 13.2.1, a patch release. Prometheus remains at 3.14.0\n* Security: fixes for CVE-2026-12704 and CVE-2026-14199\n* Fixes ad-hoc and group-by variable data sources when a dashboard is imported through the interface, bundled plugins not being moved into place during packaging, and the panel editor options pane not resizing beyond the width of the preview\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-06",
    "azure": "2026-09-09"
   }
  },
  {
   "version": "13.2.0",
   "title": "Grafana 13.2.0 + Prometheus 3.14.0",
   "notes": "* Bundled Prometheus 3.12.0 -> 3.14.0; Grafana OSS 13.2.0 unchanged. Log rotation no longer silently stops Prometheus logging: the unit writes via StandardOutput=append:, so systemd owns the fd and the previous `create` rotation left the service writing into the old renamed file while the live log stayed empty. Now uses copytruncate.\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base.\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-31",
    "azure": "2026-08-31"
   }
  },
  {
   "version": "13.2.0",
   "title": "Grafana 13.2.0 + Prometheus 3.12.0",
   "notes": "* Grafana 13.2.0 - open-source observability, dashboards, and alerting (minor update from 13.1.1). AGPL-3.0 unchanged\n* Security: fixes CVE-2026-17183\n* Alerting: an Import tab in the alerting settings page, notification-template import and a staged-configuration summary in the import-to-GMA wizard, and the notifications API moved to v1beta1\n* Scripted dashboards are deprecated and disabled by default; the alertingSaveStateCompressed feature flag is removed\n* Prometheus 3.12.0 - pre-wired metrics data source (unchanged)\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-31",
    "azure": "2026-08-31"
   }
  },
  {
   "version": "13.1.1",
   "title": "Grafana 13.1.1 + Prometheus 3.12.0",
   "notes": "* Grafana 13.1.1 - open-source observability, dashboards, and alerting (patch update from 13.1.0). AGPL-3.0 unchanged\n* Prometheus 3.12.0 - pre-wired metrics data source (unchanged)\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-23",
    "azure": "2026-07-27"
   }
  },
  {
   "version": "13.1.0",
   "title": "Grafana 13.1.0 + Prometheus 3.12.0",
   "notes": "* Grafana 13.1.0 - open-source observability, dashboards, and alerting (minor update from 13.0.3). AGPL-3.0 unchanged\n* Prometheus 3.12.0 - pre-wired metrics data source (unchanged)\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-11",
    "azure": "2026-07-19"
   }
  },
  {
   "version": "13.0.3",
   "title": "Grafana 13.0.3 + Prometheus 3.12.0",
   "notes": "* Grafana 13.0.3 - open-source observability, dashboards, and alerting (patch update from 13.0.2)\n* Prometheus 3.12.0 - pre-wired metrics data source (unchanged)\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-30"
   }
  },
  {
   "version": "13.0.2",
   "title": "Grafana 13.0.2 + Prometheus 3.12.0",
   "notes": "* Grafana 13.0.2 + Prometheus 3.12.0 on Ubuntu 24.04 LTS\n* Grafana OSS (AGPL-3.0) installed from the official Grafana apt repository - enterprise build never installed\n* Prometheus (Apache-2.0) from the official release, bound to localhost only\n* Prometheus pre-provisioned as Grafana's default data source - works at first login\n* Unique Grafana admin password generated at first launch (default admin/admin rotated away)\n* Nginx HTTPS reverse proxy on 443; Grafana usage reporting disabled\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-api",
   "live": {
    "aws": "2026-06-11",
    "azure": "2026-06-24"
   }
  }
 ],
 "release_history": [
  {
   "version": "13.2.4",
   "aws": "2026-10-23"
  },
  {
   "version": "13.2.3",
   "aws": "2026-10-02",
   "azure": "2026-10-02"
  },
  {
   "version": "13.2.2",
   "aws": "2026-09-16",
   "azure": "2026-09-17"
  },
  {
   "version": "13.2.1",
   "aws": "2026-09-06",
   "azure": "2026-09-09"
  },
  {
   "version": "13.2.0",
   "aws": "2026-08-31",
   "azure": "2026-08-31"
  },
  {
   "version": "13.1.1",
   "aws": "2026-07-23",
   "azure": "2026-07-27"
  },
  {
   "version": "13.1.0",
   "aws": "2026-07-11",
   "azure": "2026-07-19"
  },
  {
   "version": "13.0.3",
   "aws": "2026-06-30"
  },
  {
   "version": "13.0.2",
   "aws": "2026-06-11",
   "azure": "2026-06-24"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-uzalxhg6vxugi/latest \\\n  --instance-type m6i.xlarge --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer grafana --plan payg-gen2\naz vm create -g my-rg -n grafana --size Standard_D4s_v3 \\\n  --image lynxroute:grafana:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Grafana is a Go-based analytics and visualization platform that turns time-series metrics into interactive dashboards, panels, and alerts; Prometheus is a Go-based monitoring system and time-series database that scrapes and stores metrics over HTTP. In this bundle Grafana is the front door and Prometheus is the metrics backend - the two are pre-connected, with Prometheus added to Grafana as the default data source so you can open Explore and run PromQL queries (for example, \"up\") immediately. Prometheus scrapes itself and Grafana out of the box and is sized with a 15-day local retention window; add your own scrape targets to monitor application and infrastructure metrics. Grafana persists dashboards, users, and settings in an embedded SQLite database; Prometheus stores samples in its on-disk TSDB. Grafana OSS is AGPL-3.0 and Prometheus is Apache-2.0, so the entire stack is auditable with no vendor lock-in. Running your own stack keeps all metrics and dashboards inside your AWS account.",
  "image_adds": "Security hardening:\n* A unique Grafana admin password generated at first launch (the default admin/admin is rotated away)\n* Nginx reverse proxy with TLS - Grafana proxied on port 443\n* Prometheus (port 9090) bound to localhost only - Grafana is the only exposed UI\n* Grafana usage reporting and update checks disabled (no phone-home)\n* Prometheus provisioned as the default Grafana data source\n* UFW firewall - ports 22, 80, 443 only\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}