Official agent skill

Private Connectivity

Set up private network connectivity to Grafana Cloud — AWS PrivateLink, Azure Private Link, GCP Private Service Connect, and Private Data Source Connect (PDC).

OfficialApache-2.0Auto-check passedDevOps & Cloud

Install Private Connectivity

skills CLI

$ npx skills add grafana/skills --skill private-connectivity -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install grafana/skills private-connectivity --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/grafana/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/grafana-cloud/private-connectivity .claude/skills/private-connectivity && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "private-connectivity" agent skill from https://github.com/grafana/skills/tree/main/skills/grafana-cloud/private-connectivity into .claude/skills/private-connectivity/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "private-connectivity", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/grafana/skills/tree/main/skills/grafana-cloud/private-connectivity

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add grafana/skills --skill private-connectivity -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install grafana/skills private-connectivity --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/grafana/skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/grafana-cloud/private-connectivity .agents/skills/private-connectivity && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "private-connectivity" agent skill from https://github.com/grafana/skills/tree/main/skills/grafana-cloud/private-connectivity into .agents/skills/private-connectivity/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "private-connectivity", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add grafana/skills --skill private-connectivity -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install grafana/skills private-connectivity --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/grafana/skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/grafana-cloud/private-connectivity .cursor/skills/private-connectivity && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "private-connectivity" agent skill from https://github.com/grafana/skills/tree/main/skills/grafana-cloud/private-connectivity into .cursor/skills/private-connectivity/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "private-connectivity", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/grafana/skills.git --path skills/grafana-cloud/private-connectivity

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add grafana/skills --skill private-connectivity -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install grafana/skills private-connectivity --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/grafana/skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/grafana-cloud/private-connectivity .gemini/skills/private-connectivity && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "private-connectivity" agent skill from https://github.com/grafana/skills/tree/main/skills/grafana-cloud/private-connectivity into .gemini/skills/private-connectivity/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "private-connectivity", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install grafana/skills private-connectivity

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add grafana/skills --skill private-connectivity -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/grafana/skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/grafana-cloud/private-connectivity .github/skills/private-connectivity && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "private-connectivity" agent skill from https://github.com/grafana/skills/tree/main/skills/grafana-cloud/private-connectivity into .github/skills/private-connectivity/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "private-connectivity", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add grafana/skills --skill private-connectivity -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install grafana/skills private-connectivity --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/grafana/skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/grafana-cloud/private-connectivity .opencode/skills/private-connectivity && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "private-connectivity" agent skill from https://github.com/grafana/skills/tree/main/skills/grafana-cloud/private-connectivity into .opencode/skills/private-connectivity/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "private-connectivity", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: private-connectivity
GitHub stars: 282
Token cost: ~1.1k tokens
SKILL.md length: 301 words
Files: 3 (incl. references)
Skills in repo: 51
Repo updated: Oct 8, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Set up private network connectivity to Grafana Cloud — AWS PrivateLink, Azure Private Link, GCP Private Service Connect, and Private Data Source Connect (PDC).

Works in 5 steps: Find your service names. Grafana Cloud →… → Create an Interface VPC Endpoint per… → Verify private DNS resolves (CRITICAL —… → …
Sending telemetry to Grafana Cloud without traversing the public internet
SKILL.md covers Common Workflows, Prerequisites (all providers), Choosing the right option and References
Calls aws; reaches prometheus-private.us-east-0.grafana.net and logs-private.us-east-0.grafana.net; needs GRAFANA_CLOUD_API_KEY

What it does

Private Connectivity is an agent skill from grafana/skills, published by the product's own GitHub organization. Set up private network connectivity to Grafana Cloud — AWS PrivateLink, Azure Private Link, GCP Private Service Connect, and Private Data Source Connect (PDC). Provisions VPC endpoints, private endpoints, or PSC forwarding rules per signal type (metrics / logs / traces / profiles); wires Alloy to push to the private DNS endpoint instead of the public one; verifies private DNS resolution + endpoint approval state. Use when sending telemetry to Grafana Cloud without traversing the public internet, eliminating cloud…

Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 3 other files, including reference files (for example `references/aws.md` and `references/azure-gcp.md`).

It sits in DevOps & Cloud, covering Monitoring and alerting and Healthcare and finance regulation. It works with Grafana, Amazon Web Services, Microsoft Azure and Google Cloud. The licence is Apache-2.0.

When your agent uses it

Sending telemetry to Grafana Cloud without traversing the public internet
Eliminating cloud egress costs
Meeting PCI-DSS / HIPAA / data-residency compliance
Configuring PDC for private data-source queries

Example prompts

“stop paying egress”
“keep our telemetry off the public internet”
“PCI compliance for Grafana”
“/private-connectivity”

Requirements

A credential in GRAFANA_CLOUD_API_KEY

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

Find your service names. Grafana Cloud → Stack Details → "Send using AWS PrivateLink". Note one service name per signal type (metrics /…
Create an Interface VPC Endpoint per signal type
Verify private DNS resolves (CRITICAL — if this returns a public IP, Alloy will silently keep using the public path and you'll keep paying…
Update Alloy to use the private endpoint
Confirm traffic is flowing over PrivateLink: check the VPC endpoint's CloudWatch metrics for BytesProcessed after Alloy starts pushing.

What it can do on your machine

Read from SKILL.md and the folder at commit 1ccacf2. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- aws
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
- prometheus-private.us-east-0.grafana.net
- logs-private.us-east-0.grafana.net
Also links to:
- grafana.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
- GRAFANA_CLOUD_API_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Private Connectivity loads about 1.1k tokens when it runs, and up to ~2.1k if it reads all its reference files. Until then it costs about 216 tokens; SKILL.md has 301 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~216
When it runs · the whole SKILL.md, loaded when a task matches: ~1.1k
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~2.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from grafana/skills at commit 1ccacf2, republished under its Apache-2.0 licence (© grafana). 301 words, ~1,132 tokens.

Download SKILL.mdSave it as .claude/skills/private-connectivity/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.

name: private-connectivity
description: Set up private network connectivity to Grafana Cloud — AWS PrivateLink, Azure Private Link, GCP Private Service Connect, and Private Data Source Connect (PDC). Provisions VPC endpoints, private endpoints, or PSC forwarding rules per signal type (metrics / logs / traces / profiles); wires Alloy to push to the private DNS endpoint instead of the public one; verifies private DNS resolution + endpoint approval state. Use when sending telemetry to Grafana Cloud without traversing the public internet, eliminating cloud egress costs, meeting PCI-DSS / HIPAA / data-residency compliance, configuring PDC for private data-source queries, or connecting AWS / Azure / GCP workloads to Grafana — even when the user says "stop paying egress", "keep our telemetry off the public internet", or "PCI compliance for Grafana" without naming PrivateLink.
license: Apache-2.0

Grafana Cloud Private Connectivity

Docs: https://grafana.com/docs/grafana-cloud/send-data/

Send metrics, logs, traces, and profiles to Grafana Cloud entirely over your cloud provider's private backbone — no public internet exposure, no egress fees.

Common Workflows

Setting up AWS PrivateLink (most common)

Find your service names. Grafana Cloud → Stack Details → "Send using AWS PrivateLink". Note one service name per signal type (metrics / logs / traces / profiles).

Create an Interface VPC Endpoint per signal type:

bash

aws ec2 create-vpc-endpoint \
  --vpc-id vpc-12345 \
  --service-name com.amazonaws.vpce.us-east-1.vpce-svc-0abc123 \
  --vpc-endpoint-type Interface \
  --subnet-ids subnet-12345 \
  --security-group-ids sg-12345 \
  --private-dns-enabled

Verify private DNS resolves (CRITICAL — if this returns a public IP, Alloy will silently keep using the public path and you'll keep paying egress):

bash

dig +short prometheus-private.us-east-0.grafana.net
# Expected: a 10.x.x.x / 172.16-31.x.x / 192.168.x.x address
# Public IP returned → check `private_dns_enabled = true` was set and the VPC has DNS hostnames enabled

Update Alloy to use the private endpoint:

alloy

prometheus.remote_write "cloud_private" {
  endpoint {
    url = "https://prometheus-private.us-east-0.grafana.net/api/prom/push"
    basic_auth {
      username = sys.env("PROM_USER")
      password = sys.env("GRAFANA_CLOUD_API_KEY")
    }
  }
}

loki.write "cloud_private" {
  endpoint {
    url = "https://logs-private.us-east-0.grafana.net/loki/api/v1/push"
    basic_auth {
      username = sys.env("LOKI_USER")
      password = sys.env("GRAFANA_CLOUD_API_KEY")
    }
  }
}

Confirm traffic is flowing over PrivateLink: check the VPC endpoint's CloudWatch metrics for BytesProcessed after Alloy starts pushing.

Full Terraform + per-signal-type endpoint resources in references/aws.md.

Setting up Azure Private Link / GCP Private Service Connect

Different provider, same shape: create the private endpoint → wait for approval → verify private DNS → update Alloy URLs. Full CLI + verification steps in references/azure-gcp.md.

Azure-specific prereq: Pre-register your Subscription IDs with Grafana Support before starting — without this the endpoint creation hangs at "Pending".

Show full SKILL.md (121 more words)Show less

Prerequisites (all providers)

Grafana Cloud stack must be hosted on the same cloud provider (check: My Account → Stack → Details)
Create separate private endpoints for each signal type (metrics / logs / traces / profiles) — they have distinct service names
Same region only for AWS PrivateLink. Cross-region requires VPC peering first.

Choosing the right option

Scenario	Solution
Push from AWS	AWS PrivateLink
Push from Azure	Azure Private Link
Push from GCP	GCP Private Service Connect
Query private DB / Prometheus from Grafana	Private Data Source Connect (PDC) — see references/azure-gcp.md § PDC

References

references/aws.md — full AWS PrivateLink Terraform per signal type + endpoint verification (state + DNS)
references/azure-gcp.md — Azure Private Link + GCP Private Service Connect setup (Portal + CLI) + verification + Private Data Source Connect (PDC) for reverse-direction private data source queries

Files

SKILL.md and 2 other files (references) in skills/grafana-cloud/private-connectivity of grafana/skills.

SKILL.md
references/aws.md
references/azure-gcp.md

Open the folder on GitHubat commit 1ccacf2

Compare with similar skills

Private Connectivity next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Private Connectivity compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Private Connectivity this skillgrafana/skills	282	—	~1.1k	Automated safety check: Pass	Apache-2.0	2 days ago
Cloud Devopsdavila7/claude-code-templates	33k	4 repos	~1.4k	Automated safety check: Pass	MIT	today
Dt Obs Network FlowsDynatrace/dynatrace-for-ai	163	—	~2k	Automated safety check: Pass	Apache-2.0	9 days ago
Implementing Cloud Security Posture Managementmukul975/Anthropic-Cybersecurity-Skills	34k	—	~3k	Automated safety check: Pass	Apache-2.0	1 mo ago
Cloud Cost Optimizationwshobson/agents	40k	14 repos	~1.7k	Automated safety check: Pass	MIT	5 days ago
Terravision Cloud Diagramspatrickchugh/terravision	1.6k	—	~5.6k	Automated safety check: Notes	AGPL-3.0-only	4 days ago

Similar skills

Cloud Devops
davila7/claude-code-templates
Cloud infrastructure and DevOps workflow covering AWS, Azure, GCP, Kubernetes, Terraform, CI/CD, monitoring, and cloud-native development.
33k GitHub starsUsed in 4 repos~1.4k tokens
DevOps & CloudAuto-check passed
Dt Obs Network Flows
Dynatrace/dynatrace-for-ai
Network flow analysis in Dynatrace across three sources: OneAgent flows (host/process/pod-to-peer connections in the defaultnetworkflows Grail bucket), NetFlow/IPFIX/sFlow (via an OpenTelemetry…
163 GitHub stars~2k tokensUpdated 9 days ago
DevOps & CloudAuto-check passed
Implementing Cloud Security Posture Management
mukul975/Anthropic-Cybersecurity-Skills
Continuously monitor multi-cloud environments (AWS, Azure, GCP) for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Microsoft Defender for…
34k GitHub stars~3k tokensUpdated 1 mo ago
SecurityAuto-check passed
Cloud Cost Optimization
wshobson/agents
Cuts cloud spend across AWS, Azure, GCP and OCI with cost tagging, rightsizing, commitment and spot pricing models, and architecture changes.
40k GitHub starsUsed in 14 repos~1.7k tokens
DevOps & CloudAuto-check passed
Terravision Cloud Diagrams
patrickchugh/terravision
Draw cloud architecture diagrams for AWS, Azure or GCP with the official provider icon sets, using TerraVision.
1.6k GitHub stars~5.6k tokensUpdated 4 days ago
DevOps & CloudAuto-check: notes
Thesvg
glincker/thesvg
Fetch brand SVG logos and cloud architecture icons (AWS, Azure, GCP) from theSVG.
2.8k GitHub stars~1.5k tokensUpdated today
DevOps & CloudAuto-check passed

Questions about Private Connectivity

What does Private Connectivity do?

Set up private network connectivity to Grafana Cloud — AWS PrivateLink, Azure Private Link, GCP Private Service Connect, and Private Data Source Connect (PDC). Private Connectivity is an agent skill from grafana/skills, published by the product's own GitHub organization. Set up private network connectivity to Grafana Cloud — AWS PrivateLink, Azure Private Link, GCP Private Service Connect, and Private Data Source Connect (PDC).

When should I use Private Connectivity?

Private Connectivity fits situations like: sending telemetry to Grafana Cloud without traversing the public internet; eliminating cloud egress costs; meeting PCI-DSS / HIPAA / data-residency compliance; configuring PDC for private data-source queries.

How do I install Private Connectivity in Claude Code?

Run `npx skills add grafana/skills --skill private-connectivity -a claude-code`. Or copy the skill folder (skills/grafana-cloud/private-connectivity in grafana/skills) into .claude/skills/private-connectivity in your project. Claude Code loads it when a task matches its description.

How do I install Private Connectivity in Codex?

Run `npx skills add grafana/skills --skill private-connectivity -a codex`. Or copy the skill folder (skills/grafana-cloud/private-connectivity in grafana/skills) into .agents/skills/private-connectivity in your project. Codex loads it when a task matches its description.

Can I use Private Connectivity in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add grafana/skills --skill private-connectivity -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/private-connectivity, .gemini/skills/private-connectivity, .github/skills/private-connectivity and .opencode/skills/private-connectivity in your project.

What does Private Connectivity need to run?

Going by SKILL.md and its folder, Private Connectivity needs the command-line tools its instructions call (aws) and credentials named GRAFANA_CLOUD_API_KEY. Our summary lists: A credential in GRAFANA_CLOUD_API_KEY.

Does Private Connectivity access the network?

SKILL.md names 3 domains. In commands or code: prometheus-private.us-east-0.grafana.net and logs-private.us-east-0.grafana.net; the agent is likely to contact these when it follows the instructions. As links in the text: grafana.com. This is read from the text; nothing was executed.

Is Private Connectivity safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Private Connectivity use?

Private Connectivity is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Private Connectivity use?

About 1.1k tokens (SKILL.md is roughly 4.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 923 tokens, read only when the agent opens those files.

What are the alternatives to Private Connectivity?

Skills that share tags, products or a category with Private Connectivity: Cloud Devops (davila7/claude-code-templates, 33k stars), Dt Obs Network Flows (Dynatrace/dynatrace-for-ai, 163 stars), Implementing Cloud Security Posture Management (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Cloud Cost Optimization (wshobson/agents, 40k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Private Connectivity?

grafana (a GitHub organization, an official publisher) maintains it in grafana/skills, which has 282 GitHub stars. The repository holds 51 skills in this directory. The repository was last updated on October 8, 2026.

Source: grafana/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Private Connectivity

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Grafana Cloud Private Connectivity

Common Workflows

Setting up AWS PrivateLink (most common)

Setting up Azure Private Link / GCP Private Service Connect

Prerequisites (all providers)

Choosing the right option

References

Files

Compare with similar skills

Similar skills

More from grafana/skills

Related

Questions about Private Connectivity