Documentationbreadcrumb arrow Pluginsbreadcrumb arrow Amazon Aurorabreadcrumb arrow Install
Grafana Cloud Enterprise
Last reviewed: July 23, 2026

Install the Amazon Aurora data source plugin

This document explains how to install, upgrade, and verify the Amazon Aurora data source plugin across different Grafana deployment environments, and describes the network access the plugin requires at runtime. After you install the plugin, refer to Configure the Amazon Aurora data source to set up a connection.

Before you begin

Verify the following requirements before installing:

RequirementDetails
LicenseGrafana Cloud Pro or Advanced plan, or a self-managed Grafana Enterprise license that includes grafana-aurora-datasource.
Grafana version9.4.0 or later. Private data source connect requires Grafana 10.0 or later.
Network accessGrafana Cloud instances install the plugin from the catalog automatically. Self-managed installs need access to grafana.com or a local plugin ZIP file. Refer to Network requirements for the access the plugin needs at runtime.

Install the plugin

Choose the installation method that matches your Grafana deployment.

Grafana Cloud

The plugin is available to install from the plugin catalog on Pro and Advanced plans:

  1. Navigate to Administration > Plugins and data > Plugins.
  2. Search for Amazon Aurora and open the plugin page.
  3. Click Install.

Self-managed Grafana (CLI)

Bash 
grafana cli plugins install grafana-aurora-datasource

Restart Grafana after installation.

Docker

Set the GF_INSTALL_PLUGINS environment variable:

YAML 
environment:
  - GF_INSTALL_PLUGINS=grafana-aurora-datasource
  - GF_ENTERPRISE_LICENSE_TEXT=<YOUR_LICENSE>

Kubernetes (Helm chart)

Add the plugin to your Helm values:

YAML 
plugins:
  - grafana-aurora-datasource

envFromSecret: grafana-license-secret

Or use the GF_INSTALL_PLUGINS environment variable in your deployment specification:

YAML 
env:
  - name: GF_INSTALL_PLUGINS
    value: 'grafana-aurora-datasource'
  - name: GF_ENTERPRISE_LICENSE_TEXT
    valueFrom:
      secretKeyRef:
        name: grafana-license
        key: license.jwt

Air-gapped (offline) installation

For environments where the Grafana server has no internet access:

  1. Download the plugin ZIP file for your platform from the plugin catalog on a machine with internet access.

  2. Transfer the ZIP file to the Grafana server.

  3. Extract it to the plugins directory:

    Bash 
    unzip grafana-aurora-datasource-<VERSION>.zip -d /var/lib/grafana/plugins/

  4. Set ownership:

    Bash 
    chown -R grafana:grafana /var/lib/grafana/plugins/grafana-aurora-datasource

  5. Restart Grafana.

Caution

Installing the plugin offline doesn’t remove its runtime network requirements. In particular, MySQL-compatible engines require outbound access to s3.amazonaws.com when opening connections. Refer to Network requirements before deploying in an air-gapped environment.

Verify the installation

After installing, confirm the plugin is loaded:

  1. Navigate to Administration > Plugins and data > Plugins.
  2. Search for Amazon Aurora and verify the plugin appears with a status of Installed.
  3. If the plugin doesn’t appear, check the Grafana server logs for errors and refer to License and setup errors.

Network requirements

The plugin connects to your Aurora cluster directly, so the Grafana server, or the PDC agent when using private data source connect, needs the following outbound network access at runtime:

DestinationWhen it’s required
Cluster endpoint on the database portAlways. This is the Database Host and Database Port configured in the data source.
AWS STS endpoint (HTTPS)Only when using Assume Role ARN. The plugin calls AWS STS to assume the role before generating the authentication token.
s3.amazonaws.com (HTTPS)Only for MySQL-compatible engines. The plugin downloads the RDS certificate bundle from https://s3.amazonaws.com/rds-downloads/ each time it opens a connection.

The RDS authentication token itself is generated by signing the request locally, so token generation doesn’t require any additional network access.

Restricted and private networks

  • MySQL certificate bundle: The certificate bundle URL isn’t configurable and there’s no offline alternative, so security-restricted environments must allow outbound HTTPS to s3.amazonaws.com to use MySQL-compatible engines. PostgreSQL-compatible engines don’t have this requirement.
  • AWS STS through AWS PrivateLink: If Grafana or the PDC agent runs in a private subnet without internet access and you use Assume Role ARN, create a VPC interface endpoint for AWS STS (com.amazonaws.<region>.sts) and set the data source’s Endpoint field to the endpoint URL.
  • Private clusters with Grafana Cloud: Use private data source connect. The PDC agent needs outbound access to the cluster endpoint on the database port and outbound access on port 22 to Grafana Cloud endpoints.

Upgrade the plugin

On Grafana Cloud, the plugin is managed by Grafana and updates automatically.

On self-managed Grafana:

  1. Update the plugin:

    Bash 
    grafana cli plugins update grafana-aurora-datasource

  2. Restart Grafana.

  3. Verify each Aurora data source connection with Save & test.

Roll back to a previous version

If an upgrade causes issues on self-managed Grafana, you can pin a specific plugin version:

Bash 
grafana cli plugins install grafana-aurora-datasource <VERSION>

Restart Grafana after the rollback. For Docker or Kubernetes, append the version to the plugin name:

YAML 
environment:
  - GF_INSTALL_PLUGINS=grafana-aurora-datasource <VERSION>

Note

Rollback isn’t available on Grafana Cloud. If you experience issues after an automatic update, contact Grafana Support.

Uninstall the plugin

To remove the plugin from a self-managed Grafana instance:

Bash 
grafana cli plugins remove grafana-aurora-datasource

Restart Grafana after uninstalling. Existing data source configurations are preserved in the Grafana database but stop working until the plugin is reinstalled.

For Docker or Kubernetes, remove grafana-aurora-datasource from the GF_INSTALL_PLUGINS variable and redeploy.

Next steps