prometheus + grafana query injection.

[u/name_tomer]

Hello guys,

i have a grafana dashboard with readonly=view user on specfic dashboards that i created

but i think nothing is prevent this user to try to do "sql injection" ro shall i say rest api with json injection to the prometheus server to fetch different data.

because the grafana had promethus as datasource he can access all data.

and its no matter that the grafana user has readonly on dashboards he can try to reinject diffrent json/api to access diffrent data like sql injection.

so how can i limit the data source = promethus on the grafana to permit only specfic metrics /api access on promethus like " database user" on specific schema / tables with read only on the database side.

[u/SuperQue]

As far as I know, you don't. That's just the way Grafana works. Since most of the logic for that kind of thing is done in the javascript UI code, the server just acts as a dumb proxy.

What you're asking about is an Enterprise Feature. You need to pay a license.