diff --git a/examples/extras/datadog-agent/db-secret.tf.sample b/examples/extras/datadog-agent/db-secret.tf.sample
new file mode 100644
index 0000000..ad27c6c
--- /dev/null
+++ b/examples/extras/datadog-agent/db-secret.tf.sample
@@ -0,0 +1,52 @@
+locals {
+  _db_settings      = yamldecode(file("db.yml"))
+  db_settings       = { for db in local._db_settings : db.db_identifier => db }
+  app_secret_prefix = "/app/datadog/databases"
+  app_secret_name   = "csvd-datadog-databases"
+}
+
+resource "random_password" "db_password" {
+  for_each    = local.db_settings
+  length      = 30
+  lower       = true
+  special     = true
+  numeric     = true
+  upper       = true
+  min_numeric = 2
+  min_lower   = 2
+  min_special = 2
+  min_upper   = 2
+  # cannot: be / @ " space
+  override_special = "!#$%&*()-_=+[]{}<>:?"
+}
+
+resource "aws_secretsmanager_secret" "db" {
+  for_each    = local.db_settings
+  name        = format("%v/%v-new", local.app_secret_prefix, each.key)
+  description = format("Datadog Database setings for %v", each.key)
+
+  tags = merge(
+    local.base_tags,
+    local.common_tags,
+    var.application_tags,
+    { Name = format("%v/%v", local.app_secret_name, each.key) },
+  )
+}
+
+resource "aws_secretsmanager_secret_version" "db" {
+  for_each  = local.db_settings
+  secret_id = aws_secretsmanager_secret.db[each.key].id
+  secret_string = jsonencode({
+    db_username = each.value.db_username
+    db_password = random_password.db_password[each.key].result
+  })
+}
+
+output "db_values" {
+  description = "Database user, password by db instance_id"
+  sensitive   = true
+  value = { for k, v in local.db_settings : k => {
+    db_username = v.db_username
+    db_password = random_password.db_password[k].result
+  } }
+}
diff --git a/examples/extras/datadog-agent/db.yml.sample b/examples/extras/datadog-agent/db.yml.sample
new file mode 100644
index 0000000..9961e7f
--- /dev/null
+++ b/examples/extras/datadog-agent/db.yml.sample
@@ -0,0 +1,9 @@
+# use the proper settings here. The DB must be reachable from the EKS cluster
+# provide the generated password to the custmer to add into the dbmon user
+
+- db_identifier: rds-db-adsd-ddog-dev-pgs
+  db_fqdn: rds-db-adsd-ddog-dev-pgs.cixuuorvhypv.us-gov-west-1.rds.amazonaws.com
+  db_username: dbmon
+  db_port: 5432
+  account_id: 229685449397
+  account_alias: csvd-dev-gov