Rds postgres error logs from monitor user

[hulakv]

I created a user "monitor" and granted read-only access to "test" databases;
GRANT CONNECT ON DATABASE "test" TO monitor; GRANT USAGE ON SCHEMA public TO monitor; GRANT SELECT ON ALL TABLES IN SCHEMA public TO monitor;

Everything works, but RDS has a lot of errors in the logs. Monitor user trying to access the "rdsadmin" database
2025-06-16 11:02:29 UTC:10.153.17.133(37320):monitor@test:[5908]:ERROR: permission denied for database rdsadmin 2025-06-16 11:02:29 UTC:10.153.17.133(37320):monitor@test:[5908]:STATEMENT: SELECT pg_database_size($1)

Can I exclude system database? I haven't found any parameters in values.

[burningalchemist]

Hey @hulakv, since this behaviour is controlled by the query executed (and so the error is returned from the query, not from the post-processing by sql_exporter), I'd say the solution is to update your query to something like this to exclude it on the query level (the expectation is that you have access to the default postgres database):

SELECT datname, pg_database_size(datname)
FROM pg_database
WHERE has_database_privilege(datname, 'CONNECT')
  AND datallowconn
  AND datistemplate = false
  AND datname NOT IN ('rdsadmin');

Try it out and let me know if it works?

[burningalchemist]

It's not an issue of sql_exporter, so I'm moving it into Discussions (Q&A).