Backstage Observability
You set up backstage observability by linking metric and log plugins to your portal catalog. This view lets engineers check app health and read alerts in one single place. Most teams start by adding shared API keys to the portal backend files. When those roles are too broad, anyone in the portal can read private logs. Broad permissions also let users run heavy queries or view raw customer records. How to set up backstage observability in your portal The developer portal uses a central catalog
AI Observability + Backstage Security Plugins: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up backstage observability by linking metric and log plugins to your portal catalog. This view lets engineers check app health and read alerts in one single place. Most teams start by adding shared API keys to the portal backend files. When those roles are too broad, anyone in the portal can read private logs. Broad permissions also let users run heavy queries or view raw customer records.
How to set up backstage observability in your portal
The developer portal uses a central catalog to track every service your team owns. Each service entry holds metadata tags that link the app to external monitoring tools. When an engineer opens a service page, the portal reads those metadata tags. The frontend plugin then sends a request through the portal backend to fetch charts.
To make this work, admins store service account keys inside the backend settings. The backend uses those static keys to log in to your metric and log tools. Every user who views that catalog page shares the exact same backend role. The external monitoring tool sees the portal service account rather than the single human user.
Admins can also set up role rules inside the portal permission framework. These rules decide which team groups can view specific catalog items or plugin tabs. A user logs in with their work email, and the portal checks their group. If the group matches the rule, the portal loads the health charts and log streams.
What native portal permissions solve and what they miss
Native portal permissions do a great job of organizing which teams see which pages. You can hide billing services from contractors or limit production views to senior staff. This setup keeps the catalog clean and prevents basic browsing errors across teams. It solves the problem of who can open a view inside the web app.
Still, portal permissions stop working once an engineer leaves the catalog to fix an issue. Reading a chart is only the first step when a production database slows down. Engineers still need to log in to live hosts or databases to run checks. Native portal roles only decide who logs in to the dashboard view.
AI Observability + Backstage Security Plugins: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
They do not check what commands or queries an engineer runs in flight. And inside the log plugins, shared backend keys often pull back raw data. Those log lines can hold private emails, phone numbers, card numbers, or national IDs. Because the portal uses one shared key, you lose the trail of individual actions. You cannot set rules on single database statements or mask live query results.
Managing live system checks beyond dashboard views
A healthy workflow pairs dashboard views with strict controls on live system sessions. When a chart shows a spike, an engineer must run a check on the backend. Teams need a clear audit log that ties every command to one real person. Shared dashboard keys cannot give you that level of detail during an audit.
Security teams also want to protect private fields during live database checks. Data masking rewrites matched fields in results, such as emails or card numbers. This lets developers fix broken apps while keeping sensitive user details safe from exposure. You get fast bug fixes and clean audit logs at the same time.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
How do plugins fetch metrics for a specific service?
Admins add tool tags to the service metadata file in the software catalog. The plugin reads those tags and queries the monitoring API through the portal backend.
Why do shared plugin keys create audit gaps?
The external monitoring tool only sees requests coming from one shared portal service account. You cannot tell which specific engineer ran a search or exported a log file.
Can portal roles stop someone from reading sensitive data in logs?
No, portal roles only block or allow access to the plugin page itself. If a user can view the log tab, they see all text inside that stream.