Skip to content

PMM-15389 Assume IAM role for RDS monitoring (full stack) - #4548

Draft
4nte wants to merge 3 commits into
v3from
PMM-15389-rds-assume-iam-role
Draft

PMM-15389 Assume IAM role for RDS monitoring (full stack)#4548
4nte wants to merge 3 commits into
v3from
PMM-15389-rds-assume-iam-role

Conversation

@4nte

@4nte 4nte commented Aug 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Feature build for assumed-IAM-role RDS monitoring: PMM assumes an AWS IAM role instead of using static access keys to monitor RDS.

Full stack, pinned on branches we own (the contributor PR percona/pmm#5804 is left untouched):

pmm: PMM-15389-rds-assume-iam-role

  • Adopts feat: support assumed IAM roles for AWS RDS percona/pmm#5804 (assume IAM roles for RDS), authored by the original contributor.
  • Fixes the four review defects on top: pmm-agent 3.4.0 version gate, bounded + validated STS role assumption, explicit clearing of a role ARN (no silent revert to ambient credentials), and role-partition check against PMM settings.
  • Wires instance_id through the inventory node API and pmm-admin, so the rds_exporter actually has a DB instance to scrape. This delivery-surface gap predates #5804 and blocks it.

grafana: PMM-15389-rds-role-arn-ui

  • Adds the AWS IAM role ARN field to the Add Instance / Discovery credentials form, with ARN-format and keys-vs-role exclusivity validation.

Docs companion: percona/pmm#5838.

Draft: built for end-to-end testing on AWS, not for merge.

@4nte 4nte mentioned this pull request Aug 27, 2026
Open
@JNKPercona

JNKPercona commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator

Server docker: perconalab/pmm-server-fb:PR-4548-1000670
Client docker: perconalab/pmm-client-fb:PR-4548-1000670
Client tarball: https://s3.us-east-2.amazonaws.com/pmm-build-cache/PR-BUILDS/pmm-client/pmm-client-PR-4548-1000670.tar.gz
Staging instance: https://pmm.cd.percona.com/job/pmm3-aws-staging-start/parambuild/?DOCKER_VERSION=perconalab/pmm-server-fb:PR-4548-1000670&CLIENT_VERSION=https://s3.us-east-2.amazonaws.com/pmm-build-cache/PR-BUILDS/pmm-client/pmm-client-PR-4548-1000670.tar.gz

@JNKPercona

JNKPercona commented Aug 27, 2026

Copy link
Copy Markdown
Collaborator

API tests have succeded: https://pmm.cd.percona.com/job/pmm3-api-tests/7180/

@4nte
PMM-15389 Repoint FB to owned integration branches
bd21a28 
pmm: PMM-15389-rds-assume-iam-role (main + #5804 adopted + 4 defect
fixes + instance_id inventory/CLI wiring). grafana:
PMM-15389-rds-role-arn-ui (role ARN field on the Add Instance /
Discovery credentials form).

Replaces the earlier pin on the contributor fork; #5804 itself is
untouched.

Signed-off-by: Ante Gulin <ante.gulin@percona.com>
@4nte 4nte changed the title PMM-15389 Assume IAM role for RDS monitoring PMM-15389 Assume IAM role for RDS monitoring (full stack) Sep 11, 2026
@JNKPercona

JNKPercona commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

Server docker: perconalab/pmm-server-fb:PR-4548-bd21a28
Client docker: perconalab/pmm-client-fb:PR-4548-bd21a28
Client tarball: https://s3.us-east-2.amazonaws.com/pmm-build-cache/PR-BUILDS/pmm-client/pmm-client-PR-4548-bd21a28.tar.gz
Staging instance: https://pmm.cd.percona.com/job/pmm3-aws-staging-start/parambuild/?DOCKER_VERSION=perconalab/pmm-server-fb:PR-4548-bd21a28&CLIENT_VERSION=https://s3.us-east-2.amazonaws.com/pmm-build-cache/PR-BUILDS/pmm-client/pmm-client-PR-4548-bd21a28.tar.gz

1 similar comment
@JNKPercona

JNKPercona commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

Server docker: perconalab/pmm-server-fb:PR-4548-bd21a28
Client docker: perconalab/pmm-client-fb:PR-4548-bd21a28
Client tarball: https://s3.us-east-2.amazonaws.com/pmm-build-cache/PR-BUILDS/pmm-client/pmm-client-PR-4548-bd21a28.tar.gz
Staging instance: https://pmm.cd.percona.com/job/pmm3-aws-staging-start/parambuild/?DOCKER_VERSION=perconalab/pmm-server-fb:PR-4548-bd21a28&CLIENT_VERSION=https://s3.us-east-2.amazonaws.com/pmm-build-cache/PR-BUILDS/pmm-client/pmm-client-PR-4548-bd21a28.tar.gz

@JNKPercona

JNKPercona commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

API tests have failed: https://pmm.cd.percona.com/job/pmm3-api-tests/7343/

@JNKPercona

JNKPercona commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

API tests have failed: https://pmm.cd.percona.com/job/pmm3-api-tests/7344/

@4nte
PMM-15389 Rebuild FB with role-ARN version-gate fix
8862af2 
Retrigger only. pmm PMM-15389-rds-assume-iam-role now at 1ebc19b4,
which fixes the api-test TestRDSExporter/WithRoleARN failure (role ARN
was rejected for a pmm-agent that had not reported a version).

Signed-off-by: Ante Gulin <ante.gulin@percona.com>
@JNKPercona

JNKPercona commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

Server docker: perconalab/pmm-server-fb:PR-4548-8862af2
Client docker: perconalab/pmm-client-fb:PR-4548-8862af2
Client tarball: https://s3.us-east-2.amazonaws.com/pmm-build-cache/PR-BUILDS/pmm-client/pmm-client-PR-4548-8862af2.tar.gz
Staging instance: https://pmm.cd.percona.com/job/pmm3-aws-staging-start/parambuild/?DOCKER_VERSION=perconalab/pmm-server-fb:PR-4548-8862af2&CLIENT_VERSION=https://s3.us-east-2.amazonaws.com/pmm-build-cache/PR-BUILDS/pmm-client/pmm-client-PR-4548-8862af2.tar.gz

@JNKPercona

JNKPercona commented Sep 11, 2026

Copy link
Copy Markdown
Collaborator

API tests have succeded: https://pmm.cd.percona.com/job/pmm3-api-tests/7346/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@4nte @JNKPercona