Menu
AWS Identity and Access Management
User Guide

Actions, Resources, and Condition Keys for Amazon RDS

Amazon RDS (service prefix: rds) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions Defined by Amazon RDS

You can specify the following actions in the Action element of an IAM policy statement. By using policies, you define the permissions for anyone performing an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions. For details about the columns in the following table, see The Actions Table.

Actions Description Access Level Resource Types (*required) Condition Keys Dependent Actions
AddRoleToDBCluster Associates an Identity and Access Management (IAM) role from an Aurora DB cluster.

Write

cluster*

rds:DatabaseEngine

rds:DatabaseName

rds:Vpc

rds:cluster-tag

iam-role*

AddSourceIdentifierToSubscription Adds a source identifier to an existing RDS event notification subscription

Write

es*

rds:es-tag

AddTagsToResource Adds metadata tags to an Amazon RDS resource

Tagging

db

rds:db-tag

es

rds:es-tag

og

rds:og-tag

pg

rds:pg-tag

ri

rds:ri-tag

secgrp

rds:secgrp-tag

snapshot

rds:snapshot-tag

subgrp

rds:subgrp-tag

ApplyPendingMaintenanceAction Applies a pending maintenance action to a resource

Write

db*

rds:db-tag

AuthorizeDBSecurityGroupIngress Enables ingress to a DBSecurityGroup using one of two forms of authorization

Permissions management

secgrp*

rds:secgrp-tag

CopyDBClusterSnapshot Creates a snapshot of a DB cluster

Write

cluster-snapshot*

rds:cluster-snapshot-tag

CopyDBParameterGroup Copies the specified DB parameter group

Write

pg*

rds:pg-tag

CopyDBSnapshot Copies the specified DB snapshot

Write

snapshot*

rds:snapshot-tag

CopyOptionGroup Copies the specified option group

Write

og*

rds:og-tag

CreateDBCluster Creates a new Amazon Aurora DB cluster

Tagging

cluster*

rds:DatabaseEngine

rds:DatabaseName

rds:Vpc

rds:cluster-tag

cluster-pg*

rds:cluster-pg-tag

og*

rds:og-tag

subgrp*

rds:subgrp-tag

CreateDBClusterParameterGroup Create a new DB cluster parameter group

Tagging

cluster-pg*

rds:cluster-pg-tag

CreateDBClusterSnapshot Creates a snapshot of a DB cluster

Tagging

cluster*

rds:cluster-tag

cluster-snapshot*

rds:cluster-snapshot-tag

CreateDBInstance Creates a new DB instance

Tagging

db*

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:StorageSize

rds:Vpc

rds:db-tag

og*

rds:og-tag

pg*

rds:pg-tag

secgrp*

rds:secgrp-tag

subgrp*

rds:subgrp-tag

CreateDBInstanceReadReplica Creates a DB instance for a DB instance running MySQL, MariaDB, or PostgreSQL that acts as a Read Replica of a source DB instance

Tagging

db*

Piops

rds:DatabaseClass

rds:db-tag

og*

rds:og-tag

subgrp*

rds:subgrp-tag

CreateDBParameterGroup Creates a new DB parameter group

Tagging

pg*

rds:pg-tag

CreateDBSecurityGroup Creates a new DB security group. DB security groups control access to a DB instance

Tagging

secgrp*

rds:secgrp-tag

CreateDBSnapshot Creates a DBSnapshot

Tagging

db*

rds:db-tag

snapshot*

rds:snapshot-tag

CreateDBSubnetGroup Creates a new DB subnet group

Tagging

subgrp*

rds:subgrp-tag

CreateEventSubscription Creates an RDS event notification subscription

Tagging

es*

rds:es-tag

CreateOptionGroup Creates a new option group

Tagging

og*

rds:og-tag

DeleteDBCluster The DeleteDBCluster action deletes a previously provisioned DB cluster

Write

cluster*

rds:cluster-tag

cluster-snapshot*

rds:cluster-snapshot-tag

DeleteDBClusterParameterGroup Deletes a specified DB cluster parameter group

Write

cluster-pg*

rds:cluster-pg-tag

DeleteDBClusterSnapshot Deletes a DB cluster snapshot

Write

cluster-snapshot*

rds:cluster-snapshot-tag

DeleteDBInstance The DeleteDBInstance action deletes a previously provisioned DB instance

Write

db*

rds:db-tag

DeleteDBParameterGroup Deletes a specified DBParameterGroup

Write

pg*

rds:pg-tag

DeleteDBSecurityGroup Deletes a DB security group

Write

secgrp*

rds:secgrp-tag

DeleteDBSnapshot Deletes a DBSnapshot

Write

snapshot*

rds:snapshot-tag

DeleteDBSubnetGroup Deletes a DB subnet group

Write

subgrp*

rds:subgrp-tag

DeleteEventSubscription Deletes an RDS event notification subscription

Write

es*

rds:es-tag

DeleteOptionGroup Deletes an existing option group

Write

og*

rds:og-tag

DescribeAccountAttributes Lists all of the attributes for a customer account

List

DescribeCertificates Lists the set of CA certificates provided by Amazon RDS for this AWS account

List

DescribeDBClusterParameterGroups Returns a list of DBClusterParameterGroup descriptions

List

cluster-pg*

rds:cluster-pg-tag

DescribeDBClusterParameters Returns the detailed parameter list for a particular DB cluster parameter group

List

cluster-pg*

rds:cluster-pg-tag

DescribeDBClusterSnapshotAttributes Returns a list of DB cluster snapshot attribute names and values for a manual DB cluster snapshot

List

cluster-snapshot*

rds:cluster-snapshot-tag

DescribeDBClusters Returns information about provisioned Aurora DB clusters

List

cluster*

rds:cluster-tag

DescribeDBEngineVersions Returns a list of the available DB engines

List

pg*

rds:pg-tag

DescribeDBInstances Returns information about provisioned RDS instances

List

DescribeDBLogFiles Returns a list of DB log files for the DB instance

List

db*

rds:db-tag

DescribeDBParameterGroups Returns a list of DBParameterGroup descriptions

List

pg*

rds:pg-tag

DescribeDBParameters Returns the detailed parameter list for a particular DB parameter group

List

pg*

rds:pg-tag

DescribeDBSecurityGroups Returns a list of DBSecurityGroup descriptions

List

secgrp*

rds:secgrp-tag

DescribeDBSnapshotAttributes Returns a list of DB snapshot attribute names and values for a manual DB snapshot

List

snapshot*

rds:snapshot-tag

DescribeDBSnapshots Returns information about DB snapshots

List

db*

rds:db-tag

snapshot*

rds:snapshot-tag

DescribeDBSubnetGroups Returns a list of DBSubnetGroup descriptions

List

subgrp*

rds:subgrp-tag

DescribeEngineDefaultClusterParameters Returns the default engine and system parameter information for the cluster database engine

List

DescribeEngineDefaultParameters Returns the default engine and system parameter information for the specified database engine

List

DescribeEventCategories Displays a list of categories for all event source types, or, if specified, for a specified source type

List

DescribeEventSubscriptions Lists all the subscription descriptions for a customer account

List

es*

rds:es-tag

DescribeEvents Returns events related to DB instances, DB security groups, DB snapshots, and DB parameter groups for the past 14 days

List

es*

rds:es-tag

DescribeOptionGroupOptions Describes all available options

List

og*

rds:og-tag

DescribeOptionGroups Describes the available option groups

List

og*

rds:og-tag

DescribeOrderableDBInstanceOptions Returns a list of orderable DB instance options for the specified engine

List

DescribePendingMaintenanceActions Returns a list of resources (for example, DB instances) that have at least one pending maintenance action

List

db*

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:StorageSize

rds:Vpc

rds:db-tag

DescribeReservedDBInstances Returns information about reserved DB instances for this account, or about a specified reserved DB instance

List

ri*

rds:DatabaseClass

rds:MultiAz

rds:ri-tag

DescribeReservedDBInstancesOfferings Lists available reserved DB instance offerings

List

db*

rds:db-tag

DownloadCompleteDBLogFile Downloads the contents of the specified database log file.

Read

DownloadDBLogFilePortion Downloads all or a portion of the specified log file, up to 1 MB in size

Read

db*

rds:db-tag

FailoverDBCluster Forces a failover for a DB cluster

Write

cluster*

rds:cluster-tag

ListTagsForResource Lists all tags on an Amazon RDS resource

Read

db

rds:db-tag

es

rds:es-tag

og

rds:og-tag

pg

rds:pg-tag

ri

rds:ri-tag

secgrp

rds:secgrp-tag

snapshot

rds:snapshot-tag

subgrp

rds:subgrp-tag

ModifyDBCluster Modify a setting for an Amazon Aurora DB cluster

Write

cluster*

rds:Vpc

rds:cluster-tag

cluster-pg*

rds:cluster-pg-tag

og*

rds:og-tag

ModifyDBClusterParameterGroup Modifies the parameters of a DB cluster parameter group

Write

cluster-pg*

rds:cluster-pg-tag

ModifyDBClusterSnapshotAttribute Adds an attribute and values to, or removes an attribute and values from, a manual DB cluster snapshot

Write

cluster-snapshot*

rds:cluster-snapshot-tag

ModifyDBInstance Modify settings for a DB instance

Write

db*

rds:DatabaseClass

rds:MultiAz

rds:Piops

rds:StorageSize

rds:Vpc

rds:db-tag

og*

rds:og-tag

pg*

rds:pg-tag

secgrp*

rds:secgrp-tag

ModifyDBParameterGroup Modifies the parameters of a DB parameter group

Write

pg*

rds:pg-tag

ModifyDBSnapshotAttribute Adds an attribute and values to, or removes an attribute and values from, a manual DB snapshot

Write

snapshot*

rds:snapshot-tag

ModifyDBSubnetGroup Modifies an existing DB subnet group

Write

subgrp*

rds:subgrp-tag

ModifyEventSubscription Modifies an existing RDS event notification subscription

Write

es*

rds:es-tag

ModifyOptionGroup Modifies an existing option group

Write

og*

rds:og-tag

PromoteReadReplica Promotes a Read Replica DB instance to a standalone DB instance

Write

db*

rds:db-tag

PurchaseReservedDBInstancesOffering Purchases a reserved DB instance offering

Write

RebootDBInstance Rebooting a DB instance restarts the database engine service

Write

db*

rds:db-tag

RemoveSourceIdentifierFromSubscription Removes a source identifier from an existing RDS event notification subscription

Write

es*

rds:es-tag

RemoveTagsFromResource Removes metadata tags from an Amazon RDS resource

Tagging

db

rds:db-tag

es

rds:es-tag

og

rds:og-tag

pg

rds:pg-tag

ri

rds:ri-tag

secgrp

rds:secgrp-tag

snapshot

rds:snapshot-tag

subgrp

rds:subgrp-tag

ResetDBClusterParameterGroup Modifies the parameters of a DB cluster parameter group to the default value

Write

cluster-pg*

rds:cluster-pg-tag

ResetDBParameterGroup Modifies the parameters of a DB parameter group to the engine/system default value

Write

pg*

rds:pg-tag

RestoreDBClusterFromSnapshot Creates a new DB cluster from a DB cluster snapshot

Write

cluster*

rds:DatabaseEngine

rds:DatabaseName

rds:Vpc

rds:cluster-tag

cluster-snapshot*

rds:cluster-snapshot-tag

og*

rds:og-tag

RestoreDBClusterToPointInTime Restores a DB cluster to an arbitrary point in time

Write

cluster*

rds:Vpc

rds:cluster-tag

og*

rds:og-tag

subgrp*

rds:subgrp-tag

RestoreDBInstanceFromDBSnapshot Creates a new DB instance from a DB snapshot

Write

db*

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:Vpc

rds:db-tag

og*

rds:og-tag

snapshot*

rds:snapshot-tag

subgrp*

rds:subgrp-tag

RestoreDBInstanceToPointInTime Restores a DB instance to an arbitrary point in time

Write

db*

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:Vpc

rds:db-tag

og*

rds:og-tag

snapshot*

rds:snapshot-tag

subgrp*

rds:subgrp-tag

RevokeDBSecurityGroupIngress Revokes ingress from a DBSecurityGroup for previously authorized IP ranges or EC2 or VPC Security Groups

Write

secgrp*

rds:secgrp-tag

StartDBInstance Starts the DB instance

Write

db*

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:StorageSize

rds:Vpc

rds:db-tag

StopDBInstance Stops the DB instance

Write

db*

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:StorageSize

rds:Vpc

rds:db-tag

Resources Defined by RDS

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The Resource Types Table.

Resource Types ARN Condition Keys
cluster arn:${Partition}:rds:${Region}:${Account}:cluster:${DbClusteInstanceName}

rds:DatabaseEngine

rds:DatabaseName

rds:Vpc

rds:cluster-tag

cluster-pg arn:${Partition}:rds:${Region}:${Account}:cluster-snapshot:${ClusterParameterGroupName}

rds:cluster-pg-tag

cluster-snapshot arn:${Partition}:rds:${Region}:${Account}:cluster-snapshot:${ClusterSnapshotName}

rds:cluster-snapshot-tag

db arn:${Partition}:rds:${Region}:${Account}:db:${DbInstanceName}

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:StorageSize

rds:Vpc

rds:db-tag

es arn:${Partition}:rds:${Region}:${Account}:es:${SubscriptionName}

rds:es-tag

iam-role arn:${Partition}:iam::${Account}:role/${RoleNameWithPath}
og arn:${Partition}:rds:${Region}:${Account}:og:${OptionGroupName}

rds:og-tag

pg arn:${Partition}:rds:${Region}:${Account}:pg:${ParameterGroupName}

rds:pg-tag

ri arn:${Partition}:rds:${Region}:${Account}:ri:${ReservedDbInstanceName}

rds:DatabaseClass

rds:MultiAz

rds:ri-tag

secgrp arn:${Partition}:rds:${Region}:${Account}:secgrp:${SecurityGroupName}

rds:secgrp-tag

snapshot arn:${Partition}:rds:${Region}:${Account}:snapshot:${SnapshotName}

rds:snapshot-tag

subgrp arn:${Partition}:rds:${Region}:${Account}:subgrp:${SubnetGroupName}

rds:subgrp-tag

Condition Keys for Amazon RDS

Amazon RDS defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The Condition Keys Table.

To view the global condition keys that are available to all services, see Available Global Condition Keys in the IAM Policy Reference.

Condition Keys Description Type
Piops A value that contains the number of Provisioned IOPS (PIOPS) that the instance supports. Numeric
rds:DatabaseClass A type of DB instance class. String
rds:DatabaseEngine A database engine, such as MySQL. String
rds:DatabaseName The user-defined name of the database on the DB instance. String
rds:MultiAz A value that specifies whether the DB instance runs in multiple Availability Zones. To indicate that the DB instance is using Multi-AZ, specify true. Numeric
rds:Piops A value that contains the number of Provisioned IOPS (PIOPS) that the instance supports. To indicate a DB instance that does not have PIOPS enabled, specify 0. Numeric
rds:StorageSize The storage volume size (in GB). Numeric
rds:Vpc A value that specifies whether the DB instance runs in an Amazon Virtual Private Cloud (Amazon VPC). To indicate that the DB instance runs in an Amazon VPC, specify true. Boolean
rds:cluster-pg-tag A tag attached to a DB cluster parameter group. String
rds:cluster-snapshot-tag A tag attached to a DB cluster snapshot. String
rds:cluster-tag A tag attached to a DB cluster. String
rds:db-tag A tag attached to a DB instance. String
rds:es-tag A tag attached to an event subscription. String
rds:og-tag A tag attached to a DB option group. String
rds:pg-tag A tag attached to a DB parameter group String
rds:ri-tag A tag attached to a reserved DB instance. String
rds:secgrp-tag A tag attached to a DB security group. String
rds:snapshot-tag A tag attached to a DB snapshot. String
rds:subgrp-tag A tag attached to a DB subnet group. String