AWS Identity and Access Management
User Guide

Actions, Resources, and Condition Keys for Amazon RDS

Amazon RDS (service prefix: rds) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions Defined by Amazon RDS

You can specify the following actions in the Action element of an IAM policy statement. By using policies, you define the permissions for anyone performing an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions. For details about the columns in the following table, see The Actions Table.

Actions Description Access Level Resource Types (*required) Condition Keys Dependent Actions
AddRoleToDBCluster Associates an Identity and Access Management (IAM) role from an Aurora DB cluster. Write

cluster*

rds:DatabaseEngine

rds:DatabaseName

rds:Vpc

rds:cluster-tag

iam-role*

AddSourceIdentifierToSubscription Adds a source identifier to an existing RDS event notification subscription Write

es*

rds:es-tag

AddTagsToResource Adds metadata tags to an Amazon RDS resource Tagging

db

rds:db-tag

es

rds:es-tag

og

rds:og-tag

pg

rds:pg-tag

ri

rds:ri-tag

secgrp

rds:secgrp-tag

snapshot

rds:snapshot-tag

subgrp

rds:subgrp-tag

ApplyPendingMaintenanceAction Applies a pending maintenance action to a resource Write

db*

rds:db-tag

AuthorizeDBSecurityGroupIngress Enables ingress to a DBSecurityGroup using one of two forms of authorization Permissions management

secgrp*

rds:secgrp-tag

CopyDBClusterSnapshot Creates a snapshot of a DB cluster Write

cluster-snapshot*

rds:cluster-snapshot-tag

CopyDBParameterGroup Copies the specified DB parameter group Write

pg*

rds:pg-tag

CopyDBSnapshot Copies the specified DB snapshot Write

snapshot*

rds:snapshot-tag

CopyOptionGroup Copies the specified option group Write

og*

rds:og-tag

CreateDBCluster Creates a new Amazon Aurora DB cluster Tagging

cluster*

rds:DatabaseEngine

rds:DatabaseName

rds:Vpc

rds:cluster-tag

cluster-pg*

rds:cluster-pg-tag

og*

rds:og-tag

subgrp*

rds:subgrp-tag

CreateDBClusterParameterGroup Create a new DB cluster parameter group Tagging

cluster-pg*

rds:cluster-pg-tag

CreateDBClusterSnapshot Creates a snapshot of a DB cluster Tagging

cluster*

rds:cluster-tag

cluster-snapshot*

rds:cluster-snapshot-tag

CreateDBInstance Creates a new DB instance Tagging

db*

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:StorageSize

rds:Vpc

rds:db-tag

og*

rds:og-tag

pg*

rds:pg-tag

secgrp*

rds:secgrp-tag

subgrp*

rds:subgrp-tag

CreateDBInstanceReadReplica Creates a DB instance for a DB instance running MySQL, MariaDB, or PostgreSQL that acts as a Read Replica of a source DB instance Tagging

db*

Piops

rds:DatabaseClass

rds:db-tag

og*

rds:og-tag

subgrp*

rds:subgrp-tag

CreateDBParameterGroup Creates a new DB parameter group Tagging

pg*

rds:pg-tag

CreateDBSecurityGroup Creates a new DB security group. DB security groups control access to a DB instance Tagging

secgrp*

rds:secgrp-tag

CreateDBSnapshot Creates a DBSnapshot Tagging

db*

rds:db-tag

snapshot*

rds:snapshot-tag

CreateDBSubnetGroup Creates a new DB subnet group Tagging

subgrp*

rds:subgrp-tag

CreateEventSubscription Creates an RDS event notification subscription Tagging

es*

rds:es-tag

CreateOptionGroup Creates a new option group Tagging

og*

rds:og-tag

DeleteDBCluster The DeleteDBCluster action deletes a previously provisioned DB cluster Write

cluster*

rds:cluster-tag

cluster-snapshot*

rds:cluster-snapshot-tag

DeleteDBClusterParameterGroup Deletes a specified DB cluster parameter group Write

cluster-pg*

rds:cluster-pg-tag

DeleteDBClusterSnapshot Deletes a DB cluster snapshot Write

cluster-snapshot*

rds:cluster-snapshot-tag

DeleteDBInstance The DeleteDBInstance action deletes a previously provisioned DB instance Write

db*

rds:db-tag

DeleteDBParameterGroup Deletes a specified DBParameterGroup Write

pg*

rds:pg-tag

DeleteDBSecurityGroup Deletes a DB security group Write

secgrp*

rds:secgrp-tag

DeleteDBSnapshot Deletes a DBSnapshot Write

snapshot*

rds:snapshot-tag

DeleteDBSubnetGroup Deletes a DB subnet group Write

subgrp*

rds:subgrp-tag

DeleteEventSubscription Deletes an RDS event notification subscription Write

es*

rds:es-tag

DeleteOptionGroup Deletes an existing option group Write

og*

rds:og-tag

DescribeAccountAttributes Lists all of the attributes for a customer account List
DescribeCertificates Lists the set of CA certificates provided by Amazon RDS for this AWS account List
DescribeDBClusterParameterGroups Returns a list of DBClusterParameterGroup descriptions List

cluster-pg*

rds:cluster-pg-tag

DescribeDBClusterParameters Returns the detailed parameter list for a particular DB cluster parameter group List

cluster-pg*

rds:cluster-pg-tag

DescribeDBClusterSnapshotAttributes Returns a list of DB cluster snapshot attribute names and values for a manual DB cluster snapshot List

cluster-snapshot*

rds:cluster-snapshot-tag

DescribeDBClusters Returns information about provisioned Aurora DB clusters List

cluster*

rds:cluster-tag

DescribeDBEngineVersions Returns a list of the available DB engines List

pg*

rds:pg-tag

DescribeDBInstances Returns information about provisioned RDS instances List
DescribeDBLogFiles Returns a list of DB log files for the DB instance List

db*

rds:db-tag

DescribeDBParameterGroups Returns a list of DBParameterGroup descriptions List

pg*

rds:pg-tag

DescribeDBParameters Returns the detailed parameter list for a particular DB parameter group List

pg*

rds:pg-tag

DescribeDBSecurityGroups Returns a list of DBSecurityGroup descriptions List

secgrp*

rds:secgrp-tag

DescribeDBSnapshotAttributes Returns a list of DB snapshot attribute names and values for a manual DB snapshot List

snapshot*

rds:snapshot-tag

DescribeDBSnapshots Returns information about DB snapshots List

db*

rds:db-tag

snapshot*

rds:snapshot-tag

DescribeDBSubnetGroups Returns a list of DBSubnetGroup descriptions List

subgrp*

rds:subgrp-tag

DescribeEngineDefaultClusterParameters Returns the default engine and system parameter information for the cluster database engine List
DescribeEngineDefaultParameters Returns the default engine and system parameter information for the specified database engine List
DescribeEventCategories Displays a list of categories for all event source types, or, if specified, for a specified source type List
DescribeEventSubscriptions Lists all the subscription descriptions for a customer account List

es*

rds:es-tag

DescribeEvents Returns events related to DB instances, DB security groups, DB snapshots, and DB parameter groups for the past 14 days List

es*

rds:es-tag

DescribeOptionGroupOptions Describes all available options List

og*

rds:og-tag

DescribeOptionGroups Describes the available option groups List

og*

rds:og-tag

DescribeOrderableDBInstanceOptions Returns a list of orderable DB instance options for the specified engine List
DescribePendingMaintenanceActions Returns a list of resources (for example, DB instances) that have at least one pending maintenance action List

db*

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:StorageSize

rds:Vpc

rds:db-tag

DescribeReservedDBInstances Returns information about reserved DB instances for this account, or about a specified reserved DB instance List

ri*

rds:DatabaseClass

rds:MultiAz

rds:ri-tag

DescribeReservedDBInstancesOfferings Lists available reserved DB instance offerings List

db*

rds:db-tag

DownloadCompleteDBLogFile Downloads the contents of the specified database log file. Read
DownloadDBLogFilePortion Downloads all or a portion of the specified log file, up to 1 MB in size Read

db*

rds:db-tag

FailoverDBCluster Forces a failover for a DB cluster Write

cluster*

rds:cluster-tag

ListTagsForResource Lists all tags on an Amazon RDS resource Read

db

rds:db-tag

es

rds:es-tag

og

rds:og-tag

pg

rds:pg-tag

ri

rds:ri-tag

secgrp

rds:secgrp-tag

snapshot

rds:snapshot-tag

subgrp

rds:subgrp-tag

ModifyCurrentDBClusterCapacity Modify current cluster capacity for an Amazon Aurora Severless DB cluster Write

cluster*

rds:cluster-tag

ModifyDBCluster Modify a setting for an Amazon Aurora DB cluster Write

cluster*

rds:Vpc

rds:cluster-tag

cluster-pg*

rds:cluster-pg-tag

og*

rds:og-tag

ModifyDBClusterParameterGroup Modifies the parameters of a DB cluster parameter group Write

cluster-pg*

rds:cluster-pg-tag

ModifyDBClusterSnapshotAttribute Adds an attribute and values to, or removes an attribute and values from, a manual DB cluster snapshot Write

cluster-snapshot*

rds:cluster-snapshot-tag

ModifyDBInstance Modify settings for a DB instance Write

db*

rds:DatabaseClass

rds:MultiAz

rds:Piops

rds:StorageSize

rds:Vpc

rds:db-tag

og*

rds:og-tag

pg*

rds:pg-tag

secgrp*

rds:secgrp-tag

ModifyDBParameterGroup Modifies the parameters of a DB parameter group Write

pg*

rds:pg-tag

ModifyDBSnapshotAttribute Adds an attribute and values to, or removes an attribute and values from, a manual DB snapshot Write

snapshot*

rds:snapshot-tag

ModifyDBSubnetGroup Modifies an existing DB subnet group Write

subgrp*

rds:subgrp-tag

ModifyEventSubscription Modifies an existing RDS event notification subscription Write

es*

rds:es-tag

ModifyOptionGroup Modifies an existing option group Write

og*

rds:og-tag

PromoteReadReplica Promotes a Read Replica DB instance to a standalone DB instance Write

db*

rds:db-tag

PurchaseReservedDBInstancesOffering Purchases a reserved DB instance offering Write
RebootDBInstance Rebooting a DB instance restarts the database engine service Write

db*

rds:db-tag

RemoveSourceIdentifierFromSubscription Removes a source identifier from an existing RDS event notification subscription Write

es*

rds:es-tag

RemoveTagsFromResource Removes metadata tags from an Amazon RDS resource Tagging

db

rds:db-tag

es

rds:es-tag

og

rds:og-tag

pg

rds:pg-tag

ri

rds:ri-tag

secgrp

rds:secgrp-tag

snapshot

rds:snapshot-tag

subgrp

rds:subgrp-tag

ResetDBClusterParameterGroup Modifies the parameters of a DB cluster parameter group to the default value Write

cluster-pg*

rds:cluster-pg-tag

ResetDBParameterGroup Modifies the parameters of a DB parameter group to the engine/system default value Write

pg*

rds:pg-tag

RestoreDBClusterFromSnapshot Creates a new DB cluster from a DB cluster snapshot Write

cluster*

rds:DatabaseEngine

rds:DatabaseName

rds:Vpc

rds:cluster-tag

cluster-snapshot*

rds:cluster-snapshot-tag

og*

rds:og-tag

RestoreDBClusterToPointInTime Restores a DB cluster to an arbitrary point in time Write

cluster*

rds:Vpc

rds:cluster-tag

og*

rds:og-tag

subgrp*

rds:subgrp-tag

RestoreDBInstanceFromDBSnapshot Creates a new DB instance from a DB snapshot Write

db*

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:Vpc

rds:db-tag

og*

rds:og-tag

snapshot*

rds:snapshot-tag

subgrp*

rds:subgrp-tag

RestoreDBInstanceToPointInTime Restores a DB instance to an arbitrary point in time Write

db*

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:Vpc

rds:db-tag

og*

rds:og-tag

snapshot*

rds:snapshot-tag

subgrp*

rds:subgrp-tag

RevokeDBSecurityGroupIngress Revokes ingress from a DBSecurityGroup for previously authorized IP ranges or EC2 or VPC Security Groups Write

secgrp*

rds:secgrp-tag

StartDBInstance Starts the DB instance Write

db*

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:StorageSize

rds:Vpc

rds:db-tag

StopDBInstance Stops the DB instance Write

db*

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:StorageSize

rds:Vpc

rds:db-tag

Resources Defined by RDS

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The Resource Types Table.

Resource Types ARN Condition Keys
cluster arn:${Partition}:rds:${Region}:${Account}:cluster:${DbClusteInstanceName}

rds:DatabaseEngine

rds:DatabaseName

rds:Vpc

rds:cluster-tag

cluster-pg arn:${Partition}:rds:${Region}:${Account}:cluster-pg:${ClusterParameterGroupName}

rds:cluster-pg-tag

cluster-snapshot arn:${Partition}:rds:${Region}:${Account}:cluster-snapshot:${ClusterSnapshotName}

rds:cluster-snapshot-tag

db arn:${Partition}:rds:${Region}:${Account}:db:${DbInstanceName}

rds:DatabaseClass

rds:DatabaseEngine

rds:DatabaseName

rds:MultiAz

rds:Piops

rds:StorageSize

rds:Vpc

rds:db-tag

es arn:${Partition}:rds:${Region}:${Account}:es:${SubscriptionName}

rds:es-tag

iam-role arn:${Partition}:iam::${Account}:role/${RoleNameWithPath}
og arn:${Partition}:rds:${Region}:${Account}:og:${OptionGroupName}

rds:og-tag

pg arn:${Partition}:rds:${Region}:${Account}:pg:${ParameterGroupName}

rds:pg-tag

ri arn:${Partition}:rds:${Region}:${Account}:ri:${ReservedDbInstanceName}

rds:DatabaseClass

rds:MultiAz

rds:ri-tag

secgrp arn:${Partition}:rds:${Region}:${Account}:secgrp:${SecurityGroupName}

rds:secgrp-tag

snapshot arn:${Partition}:rds:${Region}:${Account}:snapshot:${SnapshotName}

rds:snapshot-tag

subgrp arn:${Partition}:rds:${Region}:${Account}:subgrp:${SubnetGroupName}

rds:subgrp-tag

Condition Keys for Amazon RDS

Amazon RDS defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The Condition Keys Table.

To view the global condition keys that are available to all services, see Available Global Condition Keys in the IAM Policy Reference.

Condition Keys Description Type
Piops A value that contains the number of Provisioned IOPS (PIOPS) that the instance supports. Numeric
rds:DatabaseClass A type of DB instance class. String
rds:DatabaseEngine A database engine, such as MySQL. String
rds:DatabaseName The user-defined name of the database on the DB instance. String
rds:MultiAz A value that specifies whether the DB instance runs in multiple Availability Zones. To indicate that the DB instance is using Multi-AZ, specify true. Numeric
rds:Piops A value that contains the number of Provisioned IOPS (PIOPS) that the instance supports. To indicate a DB instance that does not have PIOPS enabled, specify 0. Numeric
rds:StorageSize The storage volume size (in GB). Numeric
rds:Vpc A value that specifies whether the DB instance runs in an Amazon Virtual Private Cloud (Amazon VPC). To indicate that the DB instance runs in an Amazon VPC, specify true. Boolean
rds:cluster-pg-tag A tag attached to a DB cluster parameter group. String
rds:cluster-snapshot-tag A tag attached to a DB cluster snapshot. String
rds:cluster-tag A tag attached to a DB cluster. String
rds:db-tag A tag attached to a DB instance. String
rds:es-tag A tag attached to an event subscription. String
rds:og-tag A tag attached to a DB option group. String
rds:pg-tag A tag attached to a DB parameter group String
rds:ri-tag A tag attached to a reserved DB instance. String
rds:secgrp-tag A tag attached to a DB security group. String
rds:snapshot-tag A tag attached to a DB snapshot. String
rds:subgrp-tag A tag attached to a DB subnet group. String