Allow PMM to authenticate to DB with IAM role

[AngelVilardell]

Description

Hello,
We are using PMM to connect to AWS RDS from EKS. Currently PMM only allows static credentials (user and pass) to authenticate to a database to gather metrics. It could be interesting to allow IAM authentication so we can rotate the credentials with token and don't have to store credentials in other places (like aws Secretsmanager for example)
Thanks
Regards

Suggested solution

Maybe a checkbox next to the password textbox called something like "IAM authentication" that, when checked, disables/ignores the password checkbox and uses the username introduced to authenticate to the DB. As the role's policy already has the user and the resource to connect to, it should be enough

Additional context

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[Mason0920]

If you are using EKS and have installed pmm-server using a helm chart, then create the service account and configure the helm chart value to use the service account as follows. The IAM role and trust relationship should be set up as follows.

1. Create Service Account:

apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::{ACCOUNT_ID}:role/pmm-role
name: pmm-sa
  namespace: monitoring

2. Helm chart value:

...
serviceAccount:
  name: pmm-sa
...

Helm Chart reference https://github.com/percona/percona-helm-charts

3. IAM role and trust relationship setup:

Refer to this document for setup https://docs.percona.com/percona-monitoring-and-management/2/setting-up/client/aws.html#creating-an-iam-user

set the trust relationship as follows

{
    "Version": "2012-10-17",
"Statement": [
        {
            "Effect": "Allow",
            "Principal": {
"Federated": "{EKS_OIDC}"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
"StringEquals": {
                    "{EKS_OIDC}",
                    "{EKS_OIDC}:sub": "system:serviceaccount:monitoring:pmm-sa"
                }
}
        }
    ]
}

With this setting, the PMM server can authenticate to AWS RDS via an IAM role.