--- title: "Set up Amazon Aurora PostgreSQL | Database Observability documentation" description: "Set up Database Observability for Amazon Aurora PostgreSQL using Grafana Alloy and send telemetry to Grafana Cloud." --- > For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt). # Set up Amazon Aurora PostgreSQL Set up Database Observability with Grafana Cloud to collect telemetry from Amazon Aurora PostgreSQL clusters using Grafana Alloy. You configure your Aurora cluster and Alloy to forward telemetry to Grafana Cloud. If you already use the PostgreSQL integration, Database Observability extends it with query-level telemetry collected by the `database_observability.postgres` Alloy component. ## What you’ll achieve In this article, you: - Configure Amazon Aurora PostgreSQL cluster parameter groups for monitoring. - Create monitoring users with required privileges. - Configure Grafana Alloy with the Database Observability components. - Forward telemetry to Grafana Cloud. - Verify that telemetry appears in Database Observability. ## Setup steps Setting up Database Observability for Amazon Aurora PostgreSQL has three steps: 1. [**Set up your database**](#set-up-your-database): Prepare your Aurora cluster so Alloy can collect from it. 2. [**Configure Grafana Alloy**](#configure-grafana-alloy): Configure how Alloy collects telemetry and sends it to Grafana Cloud. Aurora supports a few methods to choose from. 3. [**Verify telemetry in Grafana Cloud**](#verify-telemetry-in-grafana-cloud): Check telemetry status and confirm that query metrics appear in Database Observability. ## Before you begin To complete this setup, you need: - An Amazon Aurora PostgreSQL 14.0 or later cluster. - Permission to modify the Aurora cluster parameter group. - Permission to reboot the Aurora cluster if parameter changes require it. - A PostgreSQL admin user that can create users and grant privileges. - A planned [Grafana Alloy](/docs/grafana-cloud/observe-and-act/send-data/alloy/) deployment location with network access to each Aurora instance endpoint. Estimated setup time: 20-40 minutes, excluding any required maintenance window for restarting the cluster. > Note > > Alloy should connect directly to the database host. Avoid connecting Alloy to the database through a load balancer or connection pooler such as PgBouncer as it would limit Alloy’s ability to collect accurate telemetry. ## Set up your database In this step, you’ll prepare your Amazon Aurora PostgreSQL cluster for monitoring by enabling `pg_stat_statements`, creating a monitoring user, and granting the permissions Database Observability needs. Complete this before configuring Alloy. Without it, Alloy can connect to your database, but it won’t be able to collect the telemetry required for Database Observability. ### Configure the DB cluster parameter group Enable `pg_stat_statements` and configure query tracking by adding parameters to your Amazon Aurora PostgreSQL cluster parameter group. These parameters require a cluster restart to take effect. If these values are already enabled on the parameter group attached to your cluster, you don’t need to change them or restart the cluster. If you update any parameter that requires a reboot, plan a maintenance window and wait for the cluster restart to complete before continuing. #### Required parameters Expand table | Parameter | Value | Notes | |-----------------------------|----------------------|------------------| | `shared_preload_libraries` | `pg_stat_statements` | Requires restart | | `pg_stat_statements.track` | `all` | Requires restart | | `track_activity_query_size` | `4096` | Requires restart | #### Use the Amazon RDS console 1. Open the **RDS Console** and navigate to **Parameter groups**. 2. Create a new cluster parameter group or modify an existing one with family `aurora-postgresql14`. 3. Set the parameters listed above. 4. Apply the parameter group to your Aurora cluster. 5. Reboot the cluster to apply changes. For detailed console instructions, refer to [Working with parameter groups](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_WorkingWithParamGroups.html) in the AWS documentation. #### Use Terraform Using Terraform with the `terraform-aws-modules/rds-aurora/aws` module: hcl ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```hcl create_db_cluster_parameter_group = true db_cluster_parameter_group_family = "aurora-postgresql14" db_cluster_parameter_group_name = "-parameter-group" db_cluster_parameter_group_description = "Parameter group with pg_stat_statements for monitoring" db_cluster_parameter_group_parameters = [ { name = "shared_preload_libraries" value = "pg_stat_statements" apply_method = "pending-reboot" }, { name = "pg_stat_statements.track" value = "all" apply_method = "pending-reboot" }, { name = "track_activity_query_size" value = "4096" apply_method = "pending-reboot" }, ] ``` Or using a standalone `aws_rds_cluster_parameter_group` resource: hcl ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```hcl resource "aws_rds_cluster_parameter_group" "aurora_postgres_monitoring" { name = "-parameter-group" family = "aurora-postgresql14" description = "Parameter group with pg_stat_statements for monitoring" parameter { name = "shared_preload_libraries" value = "pg_stat_statements" apply_method = "pending-reboot" } parameter { name = "pg_stat_statements.track" value = "all" apply_method = "pending-reboot" } parameter { name = "track_activity_query_size" value = "4096" apply_method = "pending-reboot" } } ``` Replace *<CLUSTER\_NAME>* with your Aurora cluster name. > Note > > If you already have a parameter group with `rds.logical_replication` enabled, for example, for replication to other services, add the `pg_stat_statements` parameters to that existing group rather than creating a new one. After applying the parameter group to your cluster and restarting, enable the extension in each database you want to monitor: SQL ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```sql CREATE EXTENSION IF NOT EXISTS pg_stat_statements; ``` Verify the extension is installed: SQL ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```sql SELECT * FROM pg_stat_statements LIMIT 1; ``` ### Create a monitoring user and grant required privileges Connect to your Amazon Aurora PostgreSQL cluster as an administrator and create the monitoring user: Create the `db-o11y` user and grant base privileges: SQL ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```sql CREATE USER "db-o11y" WITH PASSWORD ''; GRANT pg_monitor TO "db-o11y"; GRANT pg_read_all_stats TO "db-o11y"; ``` Replace *<DB\_O11Y\_PASSWORD>* with a secure password for the `db-o11y` PostgreSQL user. Verify that the user has the correct privileges to query `pg_stat_statements`: SQL ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```sql -- run with the `db-o11y` user SELECT * FROM pg_stat_statements LIMIT 1; ``` #### Disable tracking of monitoring user queries Prevent tracking of queries executed by the monitoring user itself: SQL ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```sql ALTER ROLE "db-o11y" SET pg_stat_statements.track = 'none'; ``` #### Grant object privileges for detailed data To allow collecting schema details and table information, connect to each logical database and grant access to each schema. For example, for a `payments` database: SQL ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```sql -- switch to the 'payments' database \c payments -- grant permissions in the 'public' schema GRANT USAGE ON SCHEMA public TO "db-o11y"; GRANT SELECT ON ALL TABLES IN SCHEMA public TO "db-o11y"; -- grant permissions in the 'tests' schema GRANT USAGE ON SCHEMA tests TO "db-o11y"; GRANT SELECT ON ALL TABLES IN SCHEMA tests TO "db-o11y"; ``` Alternatively, if you’re unsure which specific schemas need access, use the predefined role to grant USAGE and SELECT access to all objects: SQL ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```sql GRANT pg_read_all_data TO "db-o11y"; ``` ### Verify parameter group settings Verify that the parameter settings were applied correctly after restarting: SQL ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```sql SHOW pg_stat_statements.track; ``` Expected result: Value is `all`. SQL ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```sql SHOW track_activity_query_size; ``` Expected result: Value is `4096`. ### Database setup checkpoint Continue to Alloy configuration only after these conditions are true: - `pg_stat_statements` is in `shared_preload_libraries` and the extension is created (`SELECT * FROM pg_stat_statements LIMIT 1;` runs without error). - `pg_stat_statements.track` is `all` and `track_activity_query_size` is `4096`. - The `db-o11y` monitoring user has the required monitoring and object privileges. - The `db-o11y` monitoring user can connect from the network where Alloy will run. - Any parameter changes that required a reboot have been applied and the cluster restart is complete. After these checks pass, your Aurora cluster is ready for Database Observability. Next, configure Alloy so it can collect telemetry from the Aurora instance endpoints and send it to Grafana Cloud. ## Configure Grafana Alloy After you set up your database, choose how to configure Alloy. **Pick one:** 1. [**Configuration page (recommended)**](#option-1-configure-alloy-from-the-database-observability-configuration-page-recommended): Database Observability generates the Alloy configuration for you. Then let **Fleet Management** apply it to an enrolled collector, or choose **Manual Configuration** to download the generated file and deploy it yourself. Best for most teams. 2. [**Kubernetes Monitoring Helm chart**](#option-2-configure-alloy-with-the-grafana-kubernetes-monitoring-helm-chart): Set `databaseObservability.enabled` in your `values.yaml`. Best for teams already running Alloy through the k8s-monitoring Helm chart. 3. [**Custom configuration file (advanced)**](#option-3-configure-alloy-with-a-custom-configuration-file-advanced): Write the Alloy configuration yourself. Best for full control, custom components or relabeling, or environments the other paths don’t cover. ### Make sure you’re on a supported Alloy version Alloy `1.17.0` or later is required for Database Observability. Find the latest stable version on [Docker Hub](https://hub.docker.com/r/grafana/alloy/tags). To update, refer to the [Alloy release notes](https://github.com/grafana/alloy/releases). > Note > > New to Alloy? > > [Grafana Alloy](/docs/grafana-cloud/observe-and-act/send-data/alloy/introduction/) is an open source collector that sends your data to Grafana Cloud. Database Observability needs it to collect metrics and query telemetry from your database. > > If you don’t have it installed, refer to [Install Grafana Alloy](/docs/grafana-cloud/observe-and-act/send-data/alloy/set-up/install/) before you continue. ### Option 1: Configure Alloy from the Database Observability Configuration page (recommended) Start here for most deployments. The Configuration page (**Configuration** > **Setup**) generates the Alloy configuration for you, then lets you choose how to deploy it: - **Fleet Management**: Grafana Cloud deploys the configuration to an enrolled Alloy collector and manages it for you, so you don’t edit or ship config files by hand. Best if you want to manage collectors centrally and monitor their health from Grafana Cloud. Refer to [Introduction to Fleet Management](/docs/grafana-cloud/send-data/fleet-management/introduction/). - **Manual Configuration**: Download the generated configuration and deploy it with your own tooling. Best if you can’t use Fleet Management or you already manage Alloy deployment yourself. To start the guided setup flow: 1. Open **Database Observability** in Grafana Cloud. 2. Go to **Configuration**. 3. Open **Setup**. 4. Click **Add database**. 5. Select your database engine. 6. Follow the setup flow and choose **Fleet Management** or **Manual Configuration** when prompted. For an overview of setup methods and what appears in the **Setup** tab, refer to [Configure Alloy from the Configuration page](/docs/grafana-cloud/monitor-applications/database-observability/configure/fleet-management-integration/). ### Option 2: Configure Alloy with the Grafana Kubernetes Monitoring Helm chart Use this method if you already manage Alloy with the k8s-monitoring Helm chart. This path configures Alloy outside the Database Observability setup flow in Grafana Cloud. Extend your `values.yaml` and set `databaseObservability.enabled` to `true` within the PostgreSQL integration. YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml integrations: collector: alloy-singleton postgresql: instances: - name: jobLabel: integrations/db-o11y exporter: dataSource: host: # Must be specific instance endpoint port: 5432 database: postgres auth: usernameKey: passwordKey: sslmode: require autoDiscovery: enabled: true databaseDenyList: ["rdsadmin"] collectors: statStatements: enabled: true excludeUsers: ["db-o11y", "rdsadmin"] excludeDatabases: ["rdsadmin"] databaseObservability: enabled: true cloudProvider: aws: arn: "" secret: create: false name: namespace: logs: enabled: true labelSelectors: app.kubernetes.io/instance: ``` Replace the placeholders: - `INSTANCE_NAME`: Name for this database instance in Kubernetes. - `INSTANCE_ENDPOINT`: The specific instance endpoint. Do not use the Cluster Endpoint here; doing so breaks metric correlation during role changes. - `DB_USERNAME_SECRET_KEY`: Kubernetes secret key containing database user. - `DB_PASSWORD_SECRET_KEY`: Kubernetes secret key containing database password. - `AWS_AURORA_INSTANCE_ARN`: The specific Amazon Aurora instance Amazon Resource Name. - `SECRET_NAME`: Name of the Kubernetes secret containing database credentials. - `NAMESPACE`: Kubernetes namespace where the secret exists. To see the full set of values, refer to the k8s-monitoring Helm chart [documentation](https://github.com/grafana/k8s-monitoring-helm/blob/main/charts/k8s-monitoring/charts/feature-integrations/docs/integrations/postgresql.md#database-observability) or the [example configuration](https://github.com/grafana/k8s-monitoring-helm/tree/main/charts/k8s-monitoring/docs/examples/features/database-observability/postgresql). #### Configure AWS Secrets Manager and Kubernetes (optional) If you use AWS Secrets Manager with External Secrets Operator to manage database credentials, configure them as follows. ##### Secret path convention Store monitoring credentials in AWS Secrets Manager at a path following this convention: ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```none /kubernetes/rds//monitoring ``` ##### PostgreSQL secret format Store the secret as JSON with the following format: JSON ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```json { "username": "db-o11y", "password": "", "engine": "postgres", "host": ".rds.amazonaws.com", "port": 5432, "dbClusterIdentifier": "", "database": "postgres" } ``` Replace the placeholders: - `DB_O11Y_PASSWORD`: Password for the `db-o11y` PostgreSQL user. - `INSTANCE_ENDPOINT`: The specific instance endpoint. Do not use the Cluster Endpoint here; doing so breaks metric correlation during role changes. - `CLUSTER_NAME`: Aurora cluster name. ##### Create the secret with the AWS CLI Bash ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```bash aws secretsmanager create-secret \ --name "/kubernetes/rds//monitoring" \ --description "Alloy monitoring credentials for Amazon Aurora PostgreSQL cluster" \ --secret-string '{"username":"db-o11y","password":"","engine":"postgres","host":".rds.amazonaws.com","port":5432,"dbClusterIdentifier":"","database":"postgres"}' ``` ##### Kubernetes External Secrets configuration Use the External Secrets Operator to sync the AWS secret into Kubernetes: YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml --- apiVersion: external-secrets.io/v1beta1 kind: SecretStore metadata: name: -db-monitoring-secretstore spec: provider: aws: service: SecretsManager region: --- apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: -db-monitoring-secret spec: refreshInterval: 1h secretStoreRef: kind: SecretStore name: -db-monitoring-secretstore dataFrom: - extract: conversionStrategy: Default decodingStrategy: None key: /kubernetes/rds//monitoring metadataPolicy: None version: AWSCURRENT ``` Replace the placeholders: - `CLUSTER_NAME`: Aurora cluster name. - `AWS_REGION`: AWS region where the secret is stored. ### Option 3: Configure Alloy with a custom configuration file (advanced) Use this method if you manage Alloy configuration outside Grafana Cloud or need custom relabeling. This path configures Alloy outside the Database Observability setup flow in Grafana Cloud. #### Add the Amazon Aurora PostgreSQL configuration blocks > Note > > If you are using an Aurora primary/replica cluster setup, you must configure Grafana Alloy to connect to each **instance endpoint** individually, not the cluster endpoint. This ensures metrics and logs are correctly correlated with each node, and data is not missed during role changes or topology changes. Add these blocks to Alloy for Amazon Aurora PostgreSQL. Replace *<DB\_NAME>*. Create a `local.file` with the Data Source Name string, for example, `"postgresql://:@:/?sslmode=require"`: Alloy ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```alloy local.file "postgres_secret_" { filename = "/var/lib/alloy/postgres_secret_" is_secret = true } prometheus.exporter.postgres "postgres_" { data_source_names = [local.file.postgres_secret_.content] enabled_collectors = ["stat_statements"] stat_statements { exclude_users = ["db-o11y", "rdsadmin"] exclude_databases = ["rdsadmin"] } autodiscovery { enabled = true // Exclude the rdsadmin database on Aurora database_denylist = ["rdsadmin"] } } database_observability.postgres "postgres_" { data_source_name = local.file.postgres_secret_.content forward_to = [loki.relabel.database_observability_postgres_.receiver] targets = prometheus.exporter.postgres.postgres_.targets enable_collectors = ["query_details", "query_samples", "schema_details", "explain_plans"] cloud_provider { aws { arn = "" } } } loki.relabel "database_observability_postgres_" { forward_to = [loki.write.logs_service.receiver] rule { target_label = "instance" replacement = "" } } discovery.relabel "database_observability_postgres_" { targets = database_observability.postgres.postgres_.targets rule { target_label = "job" replacement = "integrations/db-o11y" } // OPTIONAL: relabel `instance` to `dsn` before overwriting `instance`; // the `dsn` label is used in the integration with the knowledge graph rule { source_labels = ["instance"] target_label = "dsn" } rule { target_label = "instance" replacement = "" } } prometheus.scrape "database_observability_postgres_" { targets = discovery.relabel.database_observability_postgres_.output forward_to = [prometheus.remote_write.metrics_service.receiver] } ``` Replace the placeholders: - `DB_NAME`: Database name Alloy uses in component identifiers (appears in component names and secret filenames). - `AWS_AURORA_INSTANCE_ARN`: The specific Amazon Aurora instance Amazon Resource Name for cloud provider integration. Do not use the cluster Amazon Resource Name. - `INSTANCE_LABEL`: Value that sets the `instance` label on logs and metrics (optional). - Secret file content example: `"postgresql://DB_USER:DB_PASSWORD@INSTANCE_ENDPOINT:DB_PORT/DB_DATABASE?sslmode=require"`. - `DB_USER`: Database user Alloy uses to connect (for example, `db-o11y`). - `DB_PASSWORD`: Password for the database user. - `INSTANCE_ENDPOINT`: The specific instance endpoint. Do not use the Cluster Endpoint here; doing so breaks metric correlation during role changes. - `DB_PORT`: Database port number (default: `5432`). - `DB_DATABASE`: Logical database name in the DSN (recommend: use `postgres`). Find more about the options supported by the `database_observability.postgres` component in the [reference](/docs/grafana-cloud/send-data/alloy/reference/components/database_observability/database_observability.postgres/) documentation. #### Add Prometheus and Loki write configuration Add the Prometheus remote write and Loki write configuration. From Grafana Cloud, open your stack to get the URLs and generate API tokens: Alloy ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```alloy prometheus.remote_write "metrics_service" { endpoint { url = sys.env("GCLOUD_HOSTED_METRICS_URL") basic_auth { password = sys.env("GCLOUD_RW_API_KEY") username = sys.env("GCLOUD_HOSTED_METRICS_ID") } } } loki.write "logs_service" { endpoint { url = sys.env("GCLOUD_HOSTED_LOGS_URL") basic_auth { password = sys.env("GCLOUD_RW_API_KEY") username = sys.env("GCLOUD_HOSTED_LOGS_ID") } } } ``` Replace the placeholders: - `GCLOUD_HOSTED_METRICS_URL`: Your Grafana Cloud Prometheus remote write URL. - `GCLOUD_HOSTED_METRICS_ID`: Your Grafana Cloud Prometheus instance ID (username). - `GCLOUD_HOSTED_LOGS_URL`: Your Grafana Cloud Loki write URL. - `GCLOUD_HOSTED_LOGS_ID`: Your Grafana Cloud Loki instance ID (username). - `GCLOUD_RW_API_KEY`: Grafana Cloud API token with write permissions. ## Verify telemetry in Grafana Cloud After Alloy starts, verify that Database Observability is receiving telemetry. 1. In Grafana Cloud, open **Database Observability**. 2. Go to **Configuration**. 3. Select your database instance. 4. Confirm that telemetry status checks pass. 5. Open **Queries Overview** and confirm that query metrics appear. After telemetry appears, the database instance should be visible and Queries Overview should show query metrics. Additional data such as query samples, wait events, schema details, and explain plans becomes available as Alloy collects it and as the database engine supports it. Telemetry can take a few minutes to appear. For detailed status checks, refer to [Verify telemetry status](/docs/grafana-cloud/monitor-applications/database-observability/configure/verify-telemetry-status/). ## Troubleshoot first-run issues If data doesn’t appear after setup: - If the database instance doesn’t appear in Database Observability, check Alloy connectivity and labels. - If telemetry status checks fail, use the Configuration page to identify the failed requirement. - If query metrics appear but samples, schema details, or explain plans are missing, check database privileges and `pg_stat_statements` settings. - If Alloy can’t connect to the database, check security groups, subnets, DNS, and the monitoring user’s host restrictions. For detailed guidance, refer to [Troubleshoot Alloy](/docs/grafana-cloud/monitor-applications/database-observability/troubleshoot/alloy/) or [Troubleshoot PostgreSQL](/docs/grafana-cloud/monitor-applications/database-observability/troubleshoot/postgres/). ## Next steps - [View query performance](/docs/grafana-cloud/monitor-applications/database-observability/monitor/view-query-performance/) - [Find your application’s queries](/docs/grafana-cloud/monitor-applications/database-observability/monitor/find-application-queries/) - [Link traces and queries](/docs/grafana-cloud/monitor-applications/database-observability/monitor/link-traces/) - [Analyze explain plans](/docs/grafana-cloud/monitor-applications/database-observability/investigate/analyze-explain-plans/)