rds

Amazon RDS databases, by the RDS API

Returns the status of each database instance of Amazon RDS in an AWS region, as RDS gives it, read through the RDS API with an access key that may only read. Three watches are offered, each one set on the probe.

Versions

Generic: the RDS API is one service, the same in every region and for every engine (MySQL, MariaDB, PostgreSQL, Oracle, SQL Server, and the instances of Aurora). The collector asks for its version 2014-10-31.

How it works

GET https://rds.<aws:region>.amazonaws.com/?Action=DescribeDBInstances&MaxRecords=100&Version=2014-10-31, signed by aws.sign (Signature Version 4, service rds), page after page by Marker. The answer is XML:

<DescribeDBInstancesResponse xmlns="http://rds.amazonaws.com/doc/2014-10-31/">
  <DescribeDBInstancesResult>
    <DBInstances>
      <DBInstance>
        <DBInstanceIdentifier>mysqldb</DBInstanceIdentifier>
        <DBInstanceStatus>available</DBInstanceStatus>
        <Engine>mysql</Engine>
        …
      </DBInstance>
    </DBInstances>
    <Marker>…</Marker>
  </DescribeDBInstancesResult>
  <ResponseMetadata><RequestId>…</RequestId></ResponseMetadata>
</DescribeDBInstancesResponse>

• A database is named by its identifier, DBInstanceIdentifier, unique in the account and the region.
• status is DBInstanceStatus, as RDS writes it: available, backing-up, modifying, maintenance, rebooting, stopped, storage-full, failed… Every status is listed in the RDS documentation ("Viewing instance status"); a backup, a modification or a maintenance in progress is not a fault.
• The region goes into the name of the host: a region with other characters than lower-case letters, digits and hyphens stops the collector misconfigured before anything leaves.
• A code 400, 401 or 403 stops the collector misconfigured, with the error code AWS writes (InvalidClientTokenId, AccessDenied, SignatureDoesNotMatch…); a throttled request (Throttling), a code 500 or above, or any other code but 200 stops it unreachable.

The keys come from protocol:aws: the secret key never leaves the poller, only the signature it makes. The answer is not secret; it names the master user of each database, never its password.

Prerequisites

• An IAM user with an access key, or a role whose temporary keys are set with their session token, allowed this action and nothing else:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "rds:DescribeDBInstances", "Resource": "*" }
  ]
}

The access key ID goes in protocol:aws:access-key-id, the secret key in protocol:aws:secret-access-key, the session token, for temporary keys only, in protocol:aws:session-token.

• The poller reaches rds.<region>.amazonaws.com in HTTPS, and its clock is right within a few minutes: AWS refuses a request signed more than fifteen minutes away from its own time. The certificates of AWS are issued by public authorities: the profile "Standard" trusts them.

Variables

Outputs

Watches

RDS starts again by itself, after seven days, a database stopped on purpose; one left stopped is left out by the selection of the probe.

Limits

• One region per probe. The regions of AWS in China (amazonaws.com.cn) are not served.
• The clusters of Aurora are not read as such: each instance of a cluster is a database here.
• Not checked against an AWS account: the action, its parameters and its fields are those of the Amazon RDS API Reference ("DescribeDBInstances", its sample answer), the status those of the Amazon RDS User Guide ("Viewing instance status").