Sold by: Elevarq
Deployed on AWS
Local-first, read-only PostgreSQL diagnostic collector. Passwordless onboarding to Amazon RDS and Aurora over verify-full TLS, with no diagnostic-data egress to Elevarq.
Overview
Elevarq Signals is an open-source (BSD-3-Clause) diagnostic collector for PostgreSQL that runs entirely inside your own AWS environment. It connects to a managed database, collects a structured, read-only diagnostic snapshot on a schedule, and keeps every byte local — no telemetry, and no diagnostic-data egress to Elevarq.
Your data stays in your account
- The only outbound calls are the cloud-authentication and TLS requests you configure, made to your own AWS services.
- Snapshots are written locally and exported as a portable archive for downstream analysis.
Read-only by design
- Read-only access is enforced by three independent layers.
- Unsafe roles (superuser, replication) are blocked before collection begins.
Passwordless onboarding on Amazon RDS and Aurora
- Connect with RDS IAM authentication — no long-lived database password to store or rotate.
- Or use a cloud secret store: AWS Secrets Manager or AWS Systems Manager Parameter Store.
- Every connection uses verify-full TLS and a least-privilege pg_monitor role.
Production-ready packaging
- Signed, multi-architecture container (linux/amd64 and linux/arm64), shipped with an SBOM.
- Helm chart for Amazon EKS with liveness/readiness probes, least-privilege security contexts, and a persistent volume for local snapshots.
Highlights
- Read-only by design: three independent enforcement layers, with unsafe roles (superuser, replication) blocked before collection starts
- Passwordless onboarding to Amazon RDS and Aurora via RDS IAM (or a cloud secret store) over verify-full TLS with a least-privilege pg_monitor role
- Local-first: no telemetry and no diagnostic-data egress to Elevarq; signed multi-arch container and Helm chart for Amazon EKS
Details
Sold by
Categories
Delivery method
Supported services
Delivery option
Helm chart (Amazon EKS)
Latest version
Operating system
Linux
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
This product is available free of charge. Free subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Vendor refund policy
This product is offered free of charge. There are no fees and therefore no refunds. Support is community-based via GitHub Issues at https://github.com/Elevarq/Signals .
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Helm chart (Amazon EKS)
Supported services: Learn more
- Amazon EKS
Helm chart
Helm charts are Kubernetes YAML manifests combined into a single package that can be installed on Kubernetes clusters. The containerized application is deployed on a cluster by running a single Helm install command to install the seller-provided Helm chart.
Version release notes
Elevarq Signals 1.5.1. Scheduled export now delivers natively to Amazon S3: export_dest / SIGNALS_EXPORT_DEST accepts an s3://bucket/prefix URI, uploading each per-database export ZIP with a single least-privilege PutObject (default AWS credential chain / IRSA, no static keys), server-side encrypted (SSE-S3 by default, SSE-KMS via export_s3_kms_key_id), which closes the Cloud delivery path with no external uploader. The Helm chart exposes first-class export.onCollect, export.dest, and export.s3 (region, kmsKeyId) values. Fixes: the container HEALTHCHECK now honors the configured API port (SIGNALS_LISTEN_ADDR) instead of a hardcoded 8081, so a non-default port no longer makes a working collector report unhealthy (#474); a non-writable data directory now fails early with an actionable message naming the directory and uid instead of a misleading WAL open error (#473); the Marketplace publish tooling fails closed on unset change-set template variables (#470). Filesystem export behaviour is unchanged.
Additional details
Usage instructions
Elevarq Signals 1.5.1 - Helm chart install on Amazon EKS.
The chart enables persistence by default, so a fresh EKS cluster needs the Amazon EBS CSI driver and a StorageClass before install.
-
Subscribe on AWS Marketplace to grant your account pull access to the Marketplace ECR repositories.
-
Prepare durable EBS storage. Install the EBS CSI driver via IRSA and create an encrypted gp3 StorageClass:
eksctl utils associate-iam-oidc-provider --cluster <cluster> --region us-east-1 --approve eksctl create iamserviceaccount --cluster <cluster> --region us-east-1 --namespace kube-system --name ebs-csi-controller-sa --role-name signals-ebs-csi-<cluster> --role-only --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy --approve eksctl create addon --cluster <cluster> --region us-east-1 --name aws-ebs-csi-driver --service-account-role-arn arn:aws:iam::<account>:role/signals-ebs-csi-<cluster> --force --wait
Then create a StorageClass named signals-gp3 (provisioner ebs.csi.aws.com, volumeBindingMode WaitForFirstConsumer, allowVolumeExpansion true, parameters type gp3 and encrypted true).
- Authenticate Helm to the Marketplace registry:
aws ecr get-login-password --region us-east-1 | helm registry login --username AWS --password-stdin <marketplace-ecr-registry>
- Install the chart. Put config in signals-values.yaml (target host, dbname, user; authMethod aws_rds_iam; sslmode verify-full; and persistence.storageClass signals-gp3):
helm install signals oci://<marketplace-ecr-registry>/elevarq/elevarq-signals-chart --version 1.5.1 --namespace signals --create-namespace -f signals-values.yaml
- Wait for storage and workload readiness:
kubectl -n signals wait --for=jsonpath='{.status.phase}'=Bound pvc/signals-signals-data --timeout=5m kubectl -n signals rollout status deployment/signals-signals --timeout=5m
- Verify. The Deployment is named <release>-signals, so with release name signals it is signals-signals:
kubectl -n signals exec deployment/signals-signals -- signalsctl status kubectl -n signals exec deployment/signals-signals -- signalsctl export --output /data/snapshot.zip
Signals connects passwordless over verify-full TLS with a least-privilege pg_monitor role and sends no telemetry to Elevarq. Complete the one-time database role grant (CREATE ROLE signals, GRANT rds_iam, GRANT pg_monitor) per the product documentation.
Resources
Vendor resources
Support
Vendor support
Community support via GitHub Issues at https://github.com/Elevarq/Signals . Report security vulnerabilities to security@elevarq.com (see SECURITY.md).
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Read-only PostgreSQL diagnostic signal collector, pre-installed on Amazon Linux 2023. Passwordless RDS IAM, verify-full TLS, least-privilege, no data egress.
Elevarq Professional Cloud is a senior-DBA read of your PostgreSQL and TimescaleDB databases, delivered as fixes your team can ship - running entirely in your own AWS account. Performance and reliability problems build up quietly, and most teams have no senior database expert on hand. Elevarq is built on decades of human PostgreSQL and TimescaleDB expertise that trained its AI and grounds it with deterministic rules - so it finds the risks, explains them with evidence and a confidence score, and prepares the exact change, including the SQL and how to roll it back. Every finding arrives as a ready-to-ship ticket in GitHub, GitLab, Jira, or Linear. It is read-only, never touches your production database, and sends no telemetry; your data never leaves your environment. Up to 5 databases per instance.
Root Signals is a Gen AI observability and control platform enabling developers to create, optimize, and embed LLM evaluators into production AI applications. Their solution lets teams monitor and enhance output quality - truthfulness, relevance, coherence, safety - helping prevent costly hallucinations and compliance issues.
Production-ready, security-hardened pgagroal container for PostgreSQL: restrictive shipped defaults, a non-root runtime, signed multi-arch images, a Kubernetes Helm chart, and zero telemetry.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.