diff --git a/ansible/group_vars/all.yml b/ansible/group_vars/all.yml
index 702ac7fa60..09360bc87a 100644
--- a/ansible/group_vars/all.yml
+++ b/ansible/group_vars/all.yml
@@ -622,6 +622,7 @@ enable_freezer: "no"
 enable_gnocchi: "no"
 enable_gnocchi_statsd: "no"
 enable_grafana: "{{ enable_monasca | bool }}"
+enable_grafana_external: "{{ enable_grafana | bool }}"
 enable_hacluster: "{{ enable_masakari_hostmonitor | bool }}"
 enable_heat: "{{ enable_openstack_core | bool }}"
 enable_horizon: "{{ enable_openstack_core | bool }}"
@@ -778,6 +779,7 @@ enable_elasticsearch: "{{ 'yes' if enable_central_logging | bool or enable_ospro
 enable_elasticsearch_curator: "no"
 
 enable_kibana: "{{ 'yes' if enable_central_logging | bool or enable_monasca | bool else 'no' }}"
+enable_kibana_external: "{{ enable_kibana | bool }}"
 
 ####################
 # Redis options
@@ -1102,6 +1104,7 @@ enable_prometheus_memcached_exporter: "{{ enable_memcached | bool }}"
 enable_prometheus_cadvisor: "{{ enable_prometheus | bool }}"
 enable_prometheus_fluentd_integration: "{{ enable_prometheus | bool and enable_fluentd | bool }}"
 enable_prometheus_alertmanager: "{{ enable_prometheus | bool }}"
+enable_prometheus_alertmanager_external: "{{ enable_prometheus_alertmanager | bool }}"
 enable_prometheus_ceph_mgr_exporter: "no"
 enable_prometheus_openstack_exporter: "{{ enable_prometheus | bool }}"
 enable_prometheus_elasticsearch_exporter: "{{ enable_prometheus | bool and enable_elasticsearch | bool }}"
diff --git a/ansible/roles/grafana/defaults/main.yml b/ansible/roles/grafana/defaults/main.yml
index fc1f2ccacf..2d4b4e392b 100644
--- a/ansible/roles/grafana/defaults/main.yml
+++ b/ansible/roles/grafana/defaults/main.yml
@@ -14,7 +14,7 @@ grafana_services:
         external: false
         port: "{{ grafana_server_port }}"
       grafana_server_external:
-        enabled: "{{ enable_grafana }}"
+        enabled: "{{ enable_grafana_external | bool }}"
         mode: "http"
         external: true
         port: "{{ grafana_server_port }}"
diff --git a/ansible/roles/kibana/defaults/main.yml b/ansible/roles/kibana/defaults/main.yml
index ca9c83b726..ae102faf09 100644
--- a/ansible/roles/kibana/defaults/main.yml
+++ b/ansible/roles/kibana/defaults/main.yml
@@ -17,7 +17,7 @@ kibana_services:
         auth_user: "{{ kibana_user }}"
         auth_pass: "{{ kibana_password }}"
       kibana_external:
-        enabled: "{{ enable_kibana }}"
+        enabled: "{{ enable_kibana_external | bool }}"
         mode: "http"
         external: true
         port: "{{ kibana_server_port }}"
diff --git a/ansible/roles/prometheus/defaults/main.yml b/ansible/roles/prometheus/defaults/main.yml
index 4c8e9b9b05..99e04a9109 100644
--- a/ansible/roles/prometheus/defaults/main.yml
+++ b/ansible/roles/prometheus/defaults/main.yml
@@ -66,7 +66,7 @@ prometheus_services:
         auth_user: "{{ prometheus_alertmanager_user }}"
         auth_pass: "{{ prometheus_alertmanager_password }}"
       prometheus_alertmanager_external:
-        enabled: "{{ enable_prometheus_alertmanager | bool }}"
+        enabled: "{{ enable_prometheus_alertmanager_external | bool }}"
         mode: "http"
         external: true
         port: "{{ prometheus_alertmanager_port }}"
diff --git a/etc/kolla/globals.yml b/etc/kolla/globals.yml
index de376ce922..f80dc13c2f 100644
--- a/etc/kolla/globals.yml
+++ b/etc/kolla/globals.yml
@@ -312,6 +312,7 @@ workaround_ansible_issue_8743: yes
 #enable_gnocchi: "no"
 #enable_gnocchi_statsd: "no"
 #enable_grafana: "{{ enable_monasca | bool }}"
+#enable_grafana_external: "{{ enable_grafana | bool }}"
 #enable_heat: "{{ enable_openstack_core | bool }}"
 #enable_horizon: "{{ enable_openstack_core | bool }}"
 #enable_horizon_blazar: "{{ enable_blazar | bool }}"
@@ -342,6 +343,7 @@ workaround_ansible_issue_8743: yes
 #enable_iscsid: "{{ enable_cinder | bool and enable_cinder_backend_iscsi | bool }}"
 #enable_kafka: "{{ enable_monasca | bool }}"
 #enable_kibana: "{{ 'yes' if enable_central_logging | bool or enable_monasca | bool else 'no' }}"
+#enable_kibana_external: "{{ enable_kibana | bool }}"
 #enable_kuryr: "no"
 #enable_magnum: "no"
 #enable_manila: "no"
@@ -699,6 +701,7 @@ workaround_ansible_issue_8743: yes
 #enable_prometheus_fluentd_integration: "{{ enable_prometheus | bool and enable fluentd | bool }}"
 #enable_prometheus_memcached: "{{ enable_prometheus | bool }}"
 #enable_prometheus_alertmanager: "{{ enable_prometheus | bool }}"
+#enable_prometheus_alertmanager_external: "{{ enable_prometheus_alertmanager | bool }}"
 #enable_prometheus_ceph_mgr_exporter: "no"
 #enable_prometheus_openstack_exporter: "{{ enable_prometheus | bool }}"
 #enable_prometheus_elasticsearch_exporter: "{{ enable_prometheus | bool and enable_elasticsearch | bool }}"
diff --git a/releasenotes/notes/monitoring-external-access-config-7ad510599dd49526.yaml b/releasenotes/notes/monitoring-external-access-config-7ad510599dd49526.yaml
new file mode 100644
index 0000000000..2b2fd27c8a
--- /dev/null
+++ b/releasenotes/notes/monitoring-external-access-config-7ad510599dd49526.yaml
@@ -0,0 +1,9 @@
+---
+features:
+  - |
+    Adds variables to configure whether monitoring services should be exposed
+    externally:
+
+    * ``enable_grafana_external``
+    * ``enable_kibana_external``
+    * ``enable_prometheus_alertmanager_external``