Cloudflare Exporter Prometheus
A cloudflare exporter prometheus setup pulls edge traffic stats and turns them into metrics. You deploy a small helper app that reads your zone data with an API key. Many teams set this up fast by using a global admin key. That broad role creates a huge risk if the key leaks. Anyone who finds that key can change DNS records or turn off security rules. How a cloudflare exporter prometheus pipeline works Your metric server cannot read edge data on its own. The edge API expects queries in a spec
Prometheus Security: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
A cloudflare exporter prometheus setup pulls edge traffic stats and turns them into metrics. You deploy a small helper app that reads your zone data with an API key. Many teams set this up fast by using a global admin key. That broad role creates a huge risk if the key leaks. Anyone who finds that key can change DNS records or turn off security rules.
How a cloudflare exporter prometheus pipeline works
Your metric server cannot read edge data on its own. The edge API expects queries in a specific graph format. Meanwhile, your metric database needs plain text numbers on a web page. The exporter app sits in the middle to translate this data. It runs on a timer and asks the edge API for fresh stats. Then it formats those numbers and waits for your metric server to read them.
To make this work, you must give the exporter an API token. You create this token inside your edge account dashboard. Good setups use a read-only role scoped to analytics data only. You also pick which domain zones the token can read. The exporter holds this secret key in memory while it runs. Every minute, it sends the key over the network to prove its identity. The edge API checks the role and sends back traffic counts and error rates.
What native API tokens solve and where they fall short
Scoped API tokens stop the exporter from changing your live DNS settings. They limit the app to reading stats from approved zones. This native role setup decides who can log in to the API. Still, it leaves major gaps in day-to-day team operations.
First, the secret token still lives on your server in a plain text file. Engineers who log in to that host to check logs can read the token. If someone copies that key, they can run queries from their own laptop. Edge logs will show the token working, not which person used it. You lose track of who is asking for data.
Prometheus Security: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Second, static tokens do not stop bad queries in flight. A broken script or a curious engineer can ask for huge data ranges. That drains your API rate limits and breaks other tools that need edge stats. The native token only checks if the holder has read rights. It does not inspect individual requests or block heavy queries before they run.
Securing metric collection on your servers
To reduce risk, teams must lock down both the token and the host. Start by stripping all write permissions from the metric token. Never share one API key across multiple apps or servers. Give each exporter its own scoped key so you can rotate it alone. Next, limit who can log in to the server running the exporter. If engineers need to check the app, audit every command they run. Watch for actions that print system variables or read secret files. You should also mask sensitive fields like emails or card numbers in log outputs. Masking rewrites matched fields in results so debug logs stay safe.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What permissions does the exporter API token need?
The token only needs read rights for zone analytics and account stats. Never give the metric exporter permission to edit DNS records or firewall rules.
Why did my exporter stop pulling new edge metrics?
This usually happens when the app hits the edge API rate limit. Lower how often your server scrapes the app, or reduce the number of zones.
How should we rotate the API key for the exporter?
Create a new read-only token first and update your app settings. Restart the exporter, check that metrics flow, and then delete the old token.