Monitor RDS and Aurora PostgreSQL Without Storing a Database Password

You can now monitor Amazon RDS and Aurora PostgreSQL in Atatus PostgreSQL monitoring without keeping a database password on the agent host. With managed authentication, the Atatus Infrastructure Agent connects with a short-lived AWS IAM token it signs itself, and you revoke access by editing an IAM policy instead of rotating a password that every host holds.

Managed authentication needs Infrastructure Agent 4.3.0 or later, released on September 8. Older agents ignore the aws: block and fail to authenticate. The managed authentication docs walk through each step.

What you can do

• No stored password: The agent signs its own short-lived tokens, each valid for 15 minutes. Turn on IAM database authentication on the database, grant the atatus role rds_iam and pg_monitor, and allow rds-db:connect for the IAM identity the agent uses, such as its EC2 instance role, ECS task role or EKS pod role.
• One block in the agent config: Add an aws: block with the database region and managed_authentication enabled to postgresql.yml, and remove the password: line.
• Databases in other AWS accounts: Add role_arn, plus external_id if your trust policy needs one, and the agent assumes a role in the database owner's account.
• Many databases, one agent: One agent can monitor any number of RDS and Aurora PostgreSQL databases, across regions and AWS accounts.
• Encrypted by default: TLS is required under managed authentication and defaults to verify-full. The agent ships the Amazon RDS certificate bundle, so there is no certificate to install.
• Fewer password failures: For PostgreSQL databases that still use a password, agent 4.3.0 also fixes database monitoring connections that failed when the password contained %, ?, / or :.