Check out our latest eBook: "Efficient Search in Rails with Postgres". We've updated our Terms of Service and Privacy Policy, effective Jan 30, 2021.

Step 3: Set Up IAM Policy

Almost done! 🎉

We now need to set up an IAM policy and user that the collector can use to access RDS information.

To start, go to Create IAM policy, select JSON and then paste the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "rds:DescribeDBInstances",
                "cloudwatch:GetMetricStatistics"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Action": [
                "logs:GetLogEvents"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:logs:*:*:log-group:RDSOSMetrics:log-stream:*"
        },
        {
            "Action": [
                "rds:DescribeDBParameters"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:rds:*:*:pg:*"
        },
        {
            "Action": [
                "rds:DownloadDBLogFilePortion",
                "rds:DescribeDBLogFiles"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:rds:*:*:db:*"
        }
    ]
}

This policy grants the following access:

  • RDS metadata used to discover general instance information
  • Cloudwatch metrics to show CPU utilization and other system metrics in pganalyze
  • RDS log file download (for pganalyze Log Insights)

We recommend naming the policy "pganalyze" or similar, so you can easily identify it again.

Create IAM Role

To complete this step, create an IAM role for pganalyze, and assign the policy to this new role.


In the next step we'll download and run the pganalyze collector software to one of your EC2 instances:

Proceed to Step 4: Install the Collector on an EC2 Instance


Couldn't find what you were looking for or want to talk about something specific?
Start a conversation with us →