PMM-13045 Add RDS assume role support

admin/commands/inventory/add_agent_rds_exporter.go

@@ -51,6 +51,7 @@ type AddAgentRDSExporterCommand struct {
 	NodeID                 string            `arg:"" help:"Node identifier"`
 	AWSAccessKey           string            `help:"AWS Access Key ID"`
 	AWSSecretKey           string            `help:"AWS Secret Access Key"`
+	AWSRoleArn             string            `help:"AWS IAM role ARN to assume"`
 	CustomLabels           map[string]string `mapsep:"," help:"Custom user-assigned labels"`
 	SkipConnectionCheck    bool              `help:"Skip connection check"`
 	DisableBasicMetrics    bool              `help:"Disable basic metrics"`
@@ -70,6 +71,7 @@ func (cmd *AddAgentRDSExporterCommand) RunCmd() (commands.Result, error) {
 				NodeID:                 cmd.NodeID,
 				AWSAccessKey:           cmd.AWSAccessKey,
 				AWSSecretKey:           cmd.AWSSecretKey,
+				AWSRoleArn:             cmd.AWSRoleArn,
 				CustomLabels:           *customLabels,
 				SkipConnectionCheck:    cmd.SkipConnectionCheck,
 				DisableBasicMetrics:    cmd.DisableBasicMetrics,

admin/commands/inventory/change_agent_rds_exporter.go

@@ -72,6 +72,7 @@ type ChangeAgentRDSExporterCommand struct {
 	// AWS credentials
 	AWSAccessKey *string `help:"AWS access key"`
 	AWSSecretKey *string `help:"AWS secret key"`
+	AWSRoleArn   *string `help:"AWS IAM role ARN to assume"`
 
 	// RDS-specific options
 	DisableBasicMetrics    *bool `help:"Disable basic metrics"`
@@ -95,6 +96,7 @@ func (cmd *ChangeAgentRDSExporterCommand) RunCmd() (commands.Result, error) {
 		Enable:                 cmd.Enable,
 		AWSAccessKey:           cmd.AWSAccessKey,
 		AWSSecretKey:           cmd.AWSSecretKey,
+		AWSRoleArn:             cmd.AWSRoleArn,
 		DisableBasicMetrics:    cmd.DisableBasicMetrics,
 		DisableEnhancedMetrics: cmd.DisableEnhancedMetrics,
 		EnablePushMetrics:      cmd.PushMetrics,
@@ -134,6 +136,9 @@ func (cmd *ChangeAgentRDSExporterCommand) RunCmd() (commands.Result, error) {
 	if cmd.AWSSecretKey != nil {
 		changes = append(changes, "updated AWS secret key")
 	}
+	if cmd.AWSRoleArn != nil {
+		changes = append(changes, "updated AWS role ARN")
+	}
 	if cmd.DisableBasicMetrics != nil {
 		if *cmd.DisableBasicMetrics {
 			changes = append(changes, "disabled basic metrics")

admin/commands/inventory/change_agent_rds_exporter_test.go

@@ -41,6 +41,7 @@ func TestRDSExporterChangeAgent(t *testing.T) {
 				Enable:                 new(true),
 				AWSAccessKey:           new("AKIAIOSFODNN7EXAMPLE"),
 				AWSSecretKey:           new("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"),
+				AWSRoleArn:             new("arn:aws:iam::123456789012:role/PmmRdsReadRole"),
 				DisableBasicMetrics:    new(false),
 				DisableEnhancedMetrics: new(true),
 				PushMetrics:            new(true),
@@ -60,6 +61,7 @@ func TestRDSExporterChangeAgent(t *testing.T) {
 					"enable": true,
 					"aws_access_key": "AKIAIOSFODNN7EXAMPLE",
 					"aws_secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+					"aws_role_arn": "arn:aws:iam::123456789012:role/PmmRdsReadRole",
 					"disable_basic_metrics": false,
 					"disable_enhanced_metrics": true,
 					"enable_push_metrics": true,
@@ -129,6 +131,7 @@ func TestRDSExporterChangeAgent(t *testing.T) {
 			"--enable",
 			"--aws-access-key=AKIATEST123",
 			"--aws-secret-key=secretkey123",
+			"--aws-role-arn=arn:aws:iam::123456789012:role/PmmRdsReadRole",
 			"--disable-basic-metrics",
 			"--disable-enhanced-metrics",
 			"--push-metrics",
@@ -153,6 +156,7 @@ func TestRDSExporterChangeAgent(t *testing.T) {
 				"enable": true,
 				"aws_access_key": "AKIATEST123",
 				"aws_secret_key": "secretkey123",
+				"aws_role_arn": "arn:aws:iam::123456789012:role/PmmRdsReadRole",
 				"disable_basic_metrics": true,
 				"disable_enhanced_metrics": true,
 				"enable_push_metrics": true,
@@ -188,6 +192,7 @@ Configuration changes applied:
   - enabled agent
   - updated AWS access key
   - updated AWS secret key
+  - updated AWS role ARN
   - disabled basic metrics
   - disabled enhanced metrics
   - enabled push metrics

api/inventory/v1/agents.proto

@@ -658,6 +658,8 @@ message RDSExporter {
   string node_id = 4;
   // AWS Access Key.
   string aws_access_key = 5 [(extensions.v1.sensitive) = REDACT_TYPE_FULL];
+  // AWS IAM role ARN to assume for RDS metrics collection.
+  string aws_role_arn = 27;
   // Custom user-assigned labels.
   map<string, string> custom_labels = 6;
 
@@ -1794,6 +1796,8 @@ message AddRDSExporterParams {
   string aws_access_key = 3 [(extensions.v1.sensitive) = REDACT_TYPE_FULL];
   // AWS Secret Key.
   string aws_secret_key = 4 [(extensions.v1.sensitive) = REDACT_TYPE_FULL];
+  // AWS IAM role ARN to assume for RDS metrics collection.
+  string aws_role_arn = 11;
   // Custom user-assigned labels.
   map<string, string> custom_labels = 5;
   // Skip connection check.
@@ -1821,6 +1825,8 @@ message ChangeRDSExporterParams {
   optional string aws_access_key = 5 [(extensions.v1.sensitive) = REDACT_TYPE_FULL];
   // AWS Secret Key.
   optional string aws_secret_key = 6 [(extensions.v1.sensitive) = REDACT_TYPE_FULL];
+  // AWS IAM role ARN to assume for RDS metrics collection.
+  optional string aws_role_arn = 10;
   // Disable basic metrics.
   optional bool disable_basic_metrics = 7;
   // Disable enhanced metrics.