Subchapter 52.1

Existing Agent

references/existing-agent.mdMarkdown17 KBView on GitHub

Phase 3B: Self-managed database bootstrap and existing Agent

Part of the dd-dbm-rds-postgres skill. Run Phases 0-2 in SKILL.md first; when this phase is done, return to Phase 4 there (or, on the Terraform path, to C2 in references/terraform.md).

Existing Agent · Dd Dbm RDS Postgres · datadog-labs/agent-skills · Skills Docs

sg_err=$(aws ec2 authorize-security-group-ingress --region <REGION> \
  --group-id <RDS_SECURITY_GROUP_ID> \
  --protocol tcp --port <PORT> \
  --source-group <AGENT_SECURITY_GROUP_ID> 2>&1) \
  || echo "$sg_err" | grep -q 'InvalidPermission.Duplicate' \
  || { echo "$sg_err" >&2; exit 1; }

resource "aws_secretsmanager_secret" "dbm_password" {
  name = "datadog/dbm/postgres/<DB_INSTANCE_IDENTIFIER>"
}

output "dbm_password_secret_arn" {
  value = aws_secretsmanager_secret.dbm_password.arn
}

DBM_PASSWORD_SECRET_ID="datadog/dbm/postgres/<DB_INSTANCE_IDENTIFIER>"
aws secretsmanager describe-secret --region <REGION> --secret-id "$DBM_PASSWORD_SECRET_ID" >/dev/null 2>&1 \
  || aws secretsmanager create-secret --region <REGION> --name "$DBM_PASSWORD_SECRET_ID" >/dev/null

umask 077
DBM_PASSWORD_SECRET_ID="datadog/dbm/postgres/<DB_INSTANCE_IDENTIFIER>"
aws secretsmanager describe-secret --region <REGION> --secret-id "$DBM_PASSWORD_SECRET_ID" >/dev/null \
  || { echo "secret container $DBM_PASSWORD_SECRET_ID not found - create it first" >&2; exit 1; }
if aws secretsmanager get-secret-value --region <REGION> --secret-id "$DBM_PASSWORD_SECRET_ID" \
     --query SecretString --output text 2>/dev/null \
     | jq -e '.password | type == "string" and length > 0' >/dev/null 2>&1; then
  echo "Reusing the existing datadog password in $DBM_PASSWORD_SECRET_ID"
else
  secret_file=$(mktemp); trap 'rm -f "$secret_file"' EXIT
  DBM_PASSWORD=$(aws secretsmanager get-random-password --region <REGION> \
    --password-length 32 --exclude-punctuation --require-each-included-type \
    --query RandomPassword --output text)
  [ -n "$DBM_PASSWORD" ] || { echo "could not generate a password" >&2; exit 1; }
  DBM_PASSWORD="$DBM_PASSWORD" jq -n '{password:$ENV.DBM_PASSWORD}' > "$secret_file"
  unset DBM_PASSWORD
  aws secretsmanager put-secret-value --region <REGION> --secret-id "$DBM_PASSWORD_SECRET_ID" \
    --secret-string "file://$secret_file" >/dev/null \
    || { echo "put-secret-value failed - the datadog password was not stored" >&2; exit 1; }
fi

ADMIN_SECRET_ARN=$(aws rds describe-db-instances --region <REGION> \
  --db-instance-identifier <DB_INSTANCE_IDENTIFIER> \
  --query "DBInstances[0].MasterUserSecret.SecretArn" --output text)

if [ -n "$ADMIN_SECRET_ARN" ] && [ "$ADMIN_SECRET_ARN" != "None" ]; then
  printf 'RDS-managed master secret: %s\n' "$ADMIN_SECRET_ARN"
  printf 'master username (use as <MASTER_USERNAME>): %s\n' "$(aws secretsmanager get-secret-value --region <REGION> \
    --secret-id "$ADMIN_SECRET_ARN" --query SecretString --output text | jq -r .username)"
else
  printf 'master username (use as <MASTER_USERNAME>): %s\n' "$(aws rds describe-db-instances --region <REGION> \
    --db-instance-identifier <DB_INSTANCE_IDENTIFIER> \
    --query "DBInstances[0].MasterUsername" --output text)"
fi

If the machine driving this flow can reach the endpoint (publicly accessible + SG allows your IP, or you’re on a VPN), connect directly. First save the “In every monitored database” SQL below to datadog_db.sql (it holds no secrets). The block then reads the master password (from the RDS-managed secret, or a no-echo prompt when the instance is not RDS-managed) and the datadog password from the B2 secret, all in the same shell that runs psql, so neither value crosses a command boundary, lands on argv, or appears in output. The SQL is fed on stdin, not typed into an interactive session, so nothing reaches psql history, and ON_ERROR_STOP makes any SQL error fail the block. Replace <DBNAMES> with the space-separated databases to monitor (at least postgres):
```
ADMIN_SECRET_ARN=$(aws rds describe-db-instances --region <REGION> \
  --db-instance-identifier <DB_INSTANCE_IDENTIFIER> \
  --query "DBInstances[0].MasterUserSecret.SecretArn" --output text)
PGPASSWORD=
if [ -n "$ADMIN_SECRET_ARN" ] && [ "$ADMIN_SECRET_ARN" != "None" ]; then
  PGPASSWORD
```
Remove the two-space list indentation before running it: the closing SQL heredoc marker must start at column 0 or the shell won’t recognize it. This block already runs both SQL sections below, so skip them on the direct path.
Otherwise (private RDS - common), run it from a host inside the VPC that can reach the DB (the Agent host or a bastion). If that host is SSM-managed, deliver it agentless via aws ssm send-command (never SSH). The remote script must read both credentials it needs from Secrets Manager on that host (never passed through send-command, which SSM logs), so grant that host’s role secretsmanager:GetSecretValue on both. Make the master-credentials grant temporary: add it as a separate, named policy just for bootstrap and remove it as soon as the role exists or the bootstrap is abandoned, so the Agent host keeps only the B2 password access that B4 needs:
- Master credentials - to connect as the master user. For RDS-managed instances the script reads them from the MasterUserSecret ARN resolved above. For non-managed instances the B2 secret holds only the datadog user’s password, not the master credentials, so first store the master credentials in a temporary Secrets Manager secret (the A1 pattern) for the script to read and delete it once the role exists, or fall back to an interactive client that can reach the DB.
- The datadog user’s password (<DBM_PASSWORD> in the SQL below) - from the B2 secret (datadog/dbm/postgres/<DB_INSTANCE_IDENTIFIER>). The local DBM_PASSWORD from B2 isn’t available in the remote command, and passing it via send-command would leak it in SSM logs, so the script reads it from Secrets Manager on the host too.
If the host isn’t SSM-managed, hand the user the SQL to run from a reachable machine. Classic RDS Postgres has no browser Query Editor or Data API, so there is no console-only fallback.

-- Idempotent: create the role if absent, otherwise reset its password (safe to rerun).
DO $$
BEGIN
   IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = 'datadog') THEN
      CREATE ROLE datadog LOGIN PASSWORD '<DBM_PASSWORD>';
   ELSE
      ALTER ROLE datadog WITH LOGIN PASSWORD '<DBM_PASSWORD>';
   END IF;
END
$$;

-- Postgres >= 15 only: allow the role to inherit pg_monitor privileges.
ALTER ROLE datadog INHERIT;

GRANT pg_monitor TO datadog;

CREATE SCHEMA IF NOT EXISTS datadog;
GRANT USAGE ON SCHEMA datadog TO datadog;
GRANT USAGE ON SCHEMA public TO datadog;
CREATE EXTENSION IF NOT EXISTS pg_stat_statements SCHEMA public;

CREATE OR REPLACE FUNCTION datadog.explain_statement(
   l_query TEXT,
   OUT explain JSON
)
RETURNS SETOF JSON AS
$$
DECLARE
   curs REFCURSOR;
   plan JSON;
BEGIN
   SET TRANSACTION READ ONLY;
   OPEN curs FOR EXECUTE pg_catalog.concat('EXPLAIN (FORMAT JSON) ', l_query);
   FETCH curs INTO plan;
   CLOSE curs;
   RETURN QUERY SELECT plan;
END;
$$
LANGUAGE 'plpgsql'
RETURNS NULL ON NULL INPUT
SECURITY DEFINER;

init_config:
instances:
  - dbm: true
    host: <RDS_ENDPOINT>
    port: <PORT>
    username: datadog
    password: 'ENC[datadog/dbm/postgres/<DB_INSTANCE_IDENTIFIER>;password]'
    aws:
      instance_endpoint: <RDS_ENDPOINT>
      region: <REGION>
    tags:
      - "dbinstanceidentifier:<DB_INSTANCE_IDENTIFIER>"

Existing Agent

Phase 3B: Self-managed database bootstrap and existing Agent

Existing Agent

Phase 3B: Self-managed database bootstrap and existing Agent

B1: Existing-Agent network access

B2: Password secret - Terraform and existing-Agent paths

B3: Create the monitoring user and grants (psql) - Terraform and existing-Agent paths

B4: Configure the existing Agent check