{"id":216,"date":"2018-01-26T17:07:49","date_gmt":"2018-01-26T16:07:49","guid":{"rendered":"http:\/\/blog.balazspocze.me\/?p=216"},"modified":"2026-11-10T05:52:00","modified_gmt":"2026-11-10T05:52:00","slug":"pmm-and-iam-roles","status":"publish","type":"post","link":"https:\/\/banyek.net\/?p=216&lang=en","title":{"rendered":"PMM and IAM Roles"},"content":{"rendered":"

I started to use Percona Monitoring and Management (PMM) recently because it seems promising, and my friends from Percona always recommending it to try out, and frankly, at first sight, I like it.<\/p>\n

There are few things which I am not happy about, but mostly I feel OK – but when it comes to the price\/value evaluation it becomes better – it is free.<\/p>\n

However I found a really disturbing problem, what is bugging me – it needs AWS credentials to discover hosts on RDS. Let me show you.<\/p>\n

<\/p>\n

\"\"
meh<\/figcaption><\/figure>\n

In AWS, it is generally a good idea not to use access keys, but to create IAM roles, and assign those roles to resources, which means you don’t have to worry about keeping the secret keys in safe place, but you can directly say, ‘this host can do this and that<\/em>‘. For example, I have a DB management node, which is an EC2 instance in the same subnet as my database hosts, so if I want to reach those machines, I open a VPN connection to our VPC, ssh to the DB management host, and I can do whatever I have to do. I can dump data there, I can get access to the databases with mysqlcli, I can run awscli commands on the database clusters of ours, etcetera. And needless to say, I don’t have to give any secret key of any users there, because the host is associated with an IAM role called ‘rds-management’, and that role has every right which I need.<\/p>\n

Actually, the entire setup process would be way better if the instance would support this, because then at the first moment, the user wouldn’t have to provide the instance id, because it would be able to query by itself as<\/p>\n

\n    import boto.utils\n    meta = boto.utils.get_instance_metadata()\n    id = meta['instance-id']\n  \n\n<\/code><\/pre>\n
And frankly, the best thing about this that nobody has to do anything, just to skip the window when the user has to insert the AWS Credentials in “_PMM Add Instance” page. (And OK, maybe to query the instance ID in the beginning of the app setup.)<\/p>\n
 <\/p>\n","protected":false},"excerpt":{"rendered":"
I started to use Percona Monitoring and Management (PMM) recently because it seems promising, and my friends from Percona always recommending it to try out, and frankly, at first sight, I like it. There are few things which I am not happy about, but mostly I feel OK – but when it comes to the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[134],"tags":[158,144,126,160,162],"class_list":["post-216","post","type-post","status-publish","format-standard","hentry","category-tech-en","tag-aws-en","tag-mysql-en","tag-oldblog-en","tag-pmm-en","tag-rds-en"],"_links":{"self":[{"href":"https:\/\/banyek.net\/index.php?rest_route=\/wp\/v2\/posts\/216","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/banyek.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/banyek.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/banyek.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/banyek.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=216"}],"version-history":[{"count":1,"href":"https:\/\/banyek.net\/index.php?rest_route=\/wp\/v2\/posts\/216\/revisions"}],"predecessor-version":[{"id":410,"href":"https:\/\/banyek.net\/index.php?rest_route=\/wp\/v2\/posts\/216\/revisions\/410"}],"wp:attachment":[{"href":"https:\/\/banyek.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=216"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/banyek.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=216"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/banyek.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=216"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}