Connect PostgreSQL on Amazon RDS via Log Files

Integration type: RDS Log File Collection (AWS RDS Data API)
Database engine: PostgreSQL
Target type: Instance (standalone RDS)
Applies to: Matters AI DAM

1. Overview

This integration grants Matters AI read-only access to PostgreSQL audit logs on Amazon RDS through the AWS RDS API. Matters discovers log files, downloads log portions, and reads instance metadata and parameter settings — no agent is installed on the database host and no changes are made to the transaction path.

How it works at a high level

1. You create an IAM role in your AWS account with a trust policy that allows Matters AI to assume it.

2. You attach an inline policy granting four RDS read permissions to that role.

3. You register the DB instance in Matters by providing the instance identifier, region, role ARN, and external ID.

4. Matters assumes the role, pulls PostgreSQL log files on a schedule, and parses them into the DAM pipeline.

What Matters reads: PostgreSQL server logs written by pgaudit and/or log_statement. Matters never issues DML against your database and never has database credentials for this path.

2. Prerequisites

Before starting, confirm the following on the RDS instance and in your AWS account.

2.1 On the RDS instance

• PostgreSQL logs must be written to files (not just stderr to CloudWatch) so the RDS API can serve them.

• postgresql log type is included in log exports on the instance (Log exports → PostgreSQL log).

• Parameter group changes are applied and the instance rebooted where the parameter change type requires it (pgaudit.log and shared library changes are static → reboot required).

See §2.4 for the exact parameter group configuration.

2.2 Audit path

Matters uses pgaudit as the audit source for PostgreSQL on RDS. pgaudit produces structured, per-object audit records that DAM parses directly. The exact parameter group configuration is in §2.4.

log_statement may be used as a fallback where pgaudit cannot be enabled — contact Matters support before choosing this path, as parser coverage is reduced.

2.3 In AWS

• Permission to create IAM roles and inline policies in the AWS account that owns the RDS instance.

• Ability to choose an External ID — a random secret string you will use once in the trust policy and once in the Matters UI. Treat it like a shared secret.

2.4 Configure the parameter group

Do not edit the default parameter group — AWS blocks changes to it. If your instance is currently on default.postgres<version>, create a new custom parameter group first.

1. Go to AWS Console → RDS → Parameter groups.

2. Create or select a PostgreSQL custom parameter group.

3. Click Edit parameters.

4. Update the following:

   Parameter	Value
   shared_preload_libraries	include pgaudit
   pgaudit.log	read,ddl,role,misc,write
   pgaudit.log_level	log
   pgaudit.log_parameter	1
   pgaudit.log_statement	1

5. Save the changes.

6. After applying the parameter group (see §2.5), connect to the DB and run:

   CREATE EXTENSION IF NOT EXISTS pgaudit;
   

2.5 Attach the audit-enabled parameter group to the instance

1. Go to AWS Console → RDS → Databases, select your instance.

2. Click Modify.

3. Scroll to DB parameter group.

4. Select your custom audit-enabled parameter group.

5. Click Continue.

6. Choose one:

   • Apply immediately — non-production.

   • Apply during maintenance window — production.

7. Click Modify DB instance.

Note: PostgreSQL requires a reboot for shared_preload_libraries changes to take effect.

2.6 Verify the configuration

After the reboot, connect to the instance and confirm:

SHOW shared_preload_libraries;                                -- should include pgaudit
SHOW pgaudit.log;                                             -- read,ddl,role,misc,write
SELECT * FROM pg_extension WHERE extname = 'pgaudit';         -- one row per audited DB

Also confirm that PostgreSQL log is enabled under the instance's Log exports setting.

2.7 In Matters

• Access to the Matters console with permission to add an integration.

• The DB instance identifier (the AWS-assigned name, e.g. prod-pg-01) and the AWS region (e.g. us-east-1).

3. Configure the integration in Matters

In the Matters console, open Integrations → Connect RDS via Log Files and complete the following.

3.1 Integration configuration

Click Next. The wizard now walks through three steps in AWS.

4. Step 1 — Create the IAM role with a custom trust policy

This role is what Matters AI assumes to read your logs. The trust policy pins the Matters AI AWS principal and requires the External ID you choose.

4.1 Choose an External ID

Pick a unique, non-guessable string (for example a UUID or a 32-character random string). You will use this value twice:

• Once inside the trust policy below (replace <EXTERNAL_ID>).

• Once at the end of the wizard when Matters asks for it.

If you skip the External ID, Matters falls back to account ID 471112501839 for authentication, which is weaker. We strongly recommend setting one.

4.2 Trust policy

Replace <EXTERNAL_ID> with the value you chose.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::471112501839:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<EXTERNAL_ID>"
        }
      }
    }
  ]
}

4.3 Create the role in AWS

1. Sign in to the AWS Management Console and open IAM.

2. In the left sidebar, click Roles, then Create role.

3. Under Trusted entity type, select Custom trust policy.

4. Paste the JSON above into the editor with your <EXTERNAL_ID> filled in.

5. Click Next — you will add permissions in the next step, so skip the permission selection here.

6. Enter a Role name (suggested: MattersRDSLogFilesReader) and click Create role.

Return to Matters and click I've created the Role with Trust Policy.

5. Step 2 — Attach the inline permissions policy

The policy grants four read-only permissions used to discover log files, download log content, read instance metadata, and read parameter settings.

5.1 Permissions policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MattersRdsLogCollection",
      "Effect": "Allow",
      "Action": [
        "rds:DescribeDBInstances",
        "rds:DescribeDBLogFiles",
        "rds:DownloadDBLogFilePortion",
        "rds:DescribeDBParameters"
      ],
      "Resource": "*"
    }
  ]
}

What each action is used for

Tightening the resource scope (optional but recommended for production): replace "Resource": "*" with the ARN of the specific instance, e.g. "arn:aws:rds:us-east-1:<account-id>:db:prod-pg-01".

5.2 Attach in AWS

1. Open the role you just created and go to the Permissions tab.

2. Click Add permissions → Create inline policy.

3. Select the JSON tab and paste the policy above.

4. Click Review policy, name it (suggested: MattersRDSPostgreSQLLogPolicy), and click Create policy.

Return to Matters and click I've attached the IAM policy.

6. Step 3 — Enter connection details

Provide the identifiers Matters needs to call the RDS API.

Click Connect.

Matters will:

1. Assume the role using STS with the External ID.

2. Call DescribeDBInstances and DescribeDBParameters to validate configuration.

3. Call DescribeDBLogFiles and DownloadDBLogFilePortion to begin log ingestion.

If validation succeeds, the integration moves to the Connected state and log ingestion begins.

7. Post-connection: what Matters does

Once connected, Matters continuously pulls new PostgreSQL log content, parses pgaudit / log_statement entries, and applies DAM policies. Downstream capabilities that become active:

• Query and object-level activity capture (SELECT / DML / DDL / privileged commands based on what you have logged).

• Policy-driven alerting (privileged user creation, sensitive object access, off-hours activity, etc.).

• Feed into UEBA and DDR pipelines.

• Audit evidence for RBI, DPDP, PCI-DSS, and ISO 27001 reporting.

8. Verification checklist

Use this checklist after clicking Connect.

• Integration shows Connected in Matters within a few minutes.

• DescribeDBParameters reflects pgaudit.log and/or log_statement set to your intended value.

• At least one log file appears in the ingestion view within one poll cycle.

• A test query on the database (e.g. a CREATE USER or a SELECT against a sensitive table) appears in the DAM activity view within the expected latency window.

• No AccessDenied errors are visible in the integration status panel.

9. Troubleshooting

10. Security notes

• The role granted here is read-only and scoped to four RDS API actions. It cannot modify the database, the instance, or any other AWS resource.

• Matters authenticates using STS AssumeRole with External ID — no long-lived AWS access keys are exchanged or stored.

• You can revoke access at any time by detaching the inline policy or deleting the role.

• For tighter posture, scope Resource in the inline policy to the specific DB instance ARN instead of .

11. Reference values