# Using PMM in AWS with IAM Role instead of IAM User and keys **URL:** \ **Category:** PMM 2.x\ **Tags:** pmm\ **Created:** [February 24, 2021, 4:14pm UTC](https://forums.percona.com/t/using-pmm-in-aws-with-iam-role-instead-of-iam-user-and-keys/9400 "2021-02-24T16:14:40Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![peter.takacs](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/peter.takacs/32/2974_2.png) [@peter.takacs](https://forums.percona.com/u/peter.takacs)\ **Post date:** [February 24, 2021, 4:14pm UTC](https://forums.percona.com/t/using-pmm-in-aws-with-iam-role-instead-of-iam-user-and-keys/9400/1 "2021-02-24T16:14:40Z")
We are using PMM from the AWS Marketplace to monitor AWS RDS instances. Great product. Thanks a lot. šŸ™‚ I installed the recommended way and added many RDS instances w/o any problem using an IAM User with the created keys. And the day came to rotate the used Access keyā€¦ Unfortunately I didnā€™t found an easy way (except to delete and add the instances again) to change the used IAM key. Based on the [documentation](https://www.percona.com/doc/percona-monitoring-and-management/2.x/setting-up/client/aws.html#creating-an-access-key-for-an-iam-user) I can use IAM Role instead of an IAM User with Access Keys. I created the role and attached to the policy and the EC2 instance too. My problem is that Iā€™m not able to discover/add the available RDS instances in the subscription because the ā€œ[PMM Add Instance / AWS RDS MySQL or Aurora MySQL](https://www.percona.com/doc/percona-monitoring-and-management/2.x/_images/metrics-monitor.add-instance.png)ā€ option requires a SECRET\_KEY\_ID and SECRET\_ACCESS\_KEY. How can I setup the PMM to use/force the associated IAM Role? Is there any documentation/guide in this topic? Thanks in Advance. ---
**Author:** ![Roma\_Novikov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/roma_novikov/32/1161_2.png) [@Roma\_Novikov](https://forums.percona.com/u/Roma_Novikov)\ **Post date:** [March 11, 2021, 12:12am UTC](https://forums.percona.com/t/using-pmm-in-aws-with-iam-role-instead-of-iam-user-and-keys/9400/2 "2021-03-11T00:12:50Z")
@peter.takacs the option how to set this up described in [Amazon RDS - Percona Monitoring and Management](https://www.percona.com/doc/percona-monitoring-and-management/2.x/setting-up/client/aws.html#creating-an-access-key-for-an-iam-user) but not clear ( Also, while testing it Iā€™ve found [[PMM-7690] AWS discovery and monitoring based on IAM roles is not working - Percona JIRA](https://jira.percona.com/browse/PMM-7690) so you can subscribe to the Jira issue and will be notified when weā€™ll fix this ---
**Author:** ![goran.petrovikj.ds](https://avatars.discourse-cdn.com/v4/letter/g/e495f1/32.png) [@goran.petrovikj.ds](https://forums.percona.com/u/goran.petrovikj.ds)\ **Post date:** [April 29, 2021, 3:38pm UTC](https://forums.percona.com/t/using-pmm-in-aws-with-iam-role-instead-of-iam-user-and-keys/9400/3 "2021-04-29T15:38:55Z")
We have the same issue in version 2.16.0 on AWS. ---
**Author:** ![Roma\_Novikov](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/roma_novikov/32/1161_2.png) [@Roma\_Novikov](https://forums.percona.com/u/Roma_Novikov)\ **Post date:** [April 29, 2021, 7:04pm UTC](https://forums.percona.com/t/using-pmm-in-aws-with-iam-role-instead-of-iam-user-and-keys/9400/4 "2021-04-29T19:04:15Z")
Thanks! I was able to confirm this ā€œbugā€ and itā€™s reported as [[PMM-7690] AWS discovery and monitoring based on IAM roles is not working - Percona JIRA](https://jira.percona.com/browse/PMM-7690) Weā€™ll fix it soon in 2.18 release ---
**Author:** ![goran.petrovikj.ds](https://avatars.discourse-cdn.com/v4/letter/g/e495f1/32.png) [@goran.petrovikj.ds](https://forums.percona.com/u/goran.petrovikj.ds)\ **Post date:** [April 29, 2021, 8:30pm UTC](https://forums.percona.com/t/using-pmm-in-aws-with-iam-role-instead-of-iam-user-and-keys/9400/5 "2021-04-29T20:30:26Z")
Great, thank you for the fast feedback! Looking forward to the fix šŸ™‚ ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [July 21, 2023, 3:59pm UTC](https://forums.percona.com/t/using-pmm-in-aws-with-iam-role-instead-of-iam-user-and-keys/9400/6 "2023-07-21T15:59:50Z")
This appears to be resolved. [https://jira.percona.com/browse/PMM-7690](https://jira.percona.com/browse/PMM-7690) ---
**Author:** ![theprasun](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@theprasun](https://forums.percona.com/u/theprasun)\ **Post date:** [September 27, 2023, 6:46pm UTC](https://forums.percona.com/t/using-pmm-in-aws-with-iam-role-instead-of-iam-user-and-keys/9400/7 "2023-09-27T18:46:22Z")
@matthewb Could help me with resolution of this issue? I couldnā€™t find it on PMM-7690. I am getting this error while trying to list RDS Instance through role. ā€˜The security token included in the request is invalidā€™.