Install and safely upgrade a remote database agent without opening inbound database access.

1. Attach the required IAM policy

In AWS Console, open EC2, select the agent instance, open its IAM role, and attach a policy containing these core read-only actions. Use the same policy with `aws iam create-policy` if your team prefers CLI.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "SmartDBARDSCoreRead",
    "Effect": "Allow",
    "Action": [
      "cloudwatch:GetMetricData",
      "ec2:DescribeSecurityGroups",
      "rds:DescribeDBInstances",
      "rds:DescribeEvents",
      "rds:DescribeDBInstanceAutomatedBackups"
    ],
    "Resource": "*"
  }]
}

Database Insights, AWS Backup, Security Hub, and Compute Optimizer permissions are optional modules. Missing optional access must appear as unavailable coverage, not as a healthy result.

2. Test access from the Hub

In Instances, open the RDS row menu and choose Test AWS Access. Required and optional permission coverage is returned by the assigned customer agent over the existing WebSocket. The browser does not send AWS keys or role values.

Live result on 2026-09-01: agent 0.1.27 uses the ec2-s3-full-access ambient role and passes all seven required checks: configuration, identity, CloudWatch, RDS inventory, network, RDS events, and automated backups. Coverage is 7/11. Database Insights, Security Hub, Compute Optimizer, and AWS Backup remain optional gaps. The replacement identifier is growaasan-stage-rds-02; the retired ...-01 identifier returns DBInstanceNotFoundFault.

sudo /root/.dba-agent/.venv/bin/python - <<'PY'
import boto3

session = boto3.Session(region_name="ap-south-1")
identity = session.client("sts").get_caller_identity()
database = session.client("rds").describe_db_instances(
    DBInstanceIdentifier="growaasan-stage-rds-02"
)["DBInstances"][0]
print("IAM ARN:", identity["Arn"])
print("RDS:", database["DBInstanceIdentifier"], database["DBInstanceStatus"])
print("Class:", database["DBInstanceClass"], "MultiAZ:", database["MultiAZ"])
PY

4. Keep Hub metadata authoritative

• The Smart DBA RDS instance is already registered with region and exact RDS identifier.
• For a same-account EC2 role, leave `cloud_role_arn` blank; no additional agent environment is needed.
• For cross-account access, set the approved role ARN on the Hub instance and grant only `sts:AssumeRole` to that role.
• Use `DBA_AWS_ROLE_EXTERNAL_ID` on the agent host only when the target role trust policy requires it.
• Do not add Hub-managed database or AWS configuration to `/root/.dba-agent/agent.yaml`.