The
UpdateCluster API allows you to modify both single-Region and multi-Region cluster configurations. With the
multiRegionProperties parameter, you can add or modify witness Region support and manage peer relationships with clusters in other Regions.
Note that updating multi-Region clusters requires additional IAM permissions beyond those needed for standard cluster updates, as detailed in the Permissions section.
Required permissions- dsql:UpdateCluster
- Permission to update a DSQL cluster.
Resources: arn:aws:dsql:region:account-id:cluster/cluster-id
- dsql:PutMultiRegionProperties
- Permission to configure multi-Region properties for a cluster.
Resources: arn:aws:dsql:region:account-id:cluster/cluster-id
- dsql:GetCluster
- Permission to retrieve cluster information.
Resources: arn:aws:dsql:region:account-id:cluster/cluster-id
- dsql:AddPeerCluster
- Permission to add peer clusters.
Resources:
- Local cluster: arn:aws:dsql:region:account-id:cluster/cluster-id
- Each peer cluster: exact ARN of each specified peer cluster
- dsql:RemovePeerCluster
- Permission to remove peer clusters. When you list peer clusters in multiRegionProperties.clusters, you need this permission for each current peer cluster that your list omits.
Resources:
- Each removed peer cluster: exact ARN of each removed peer cluster, in its own Region
- dsql:PutWitnessRegion
- Permission to set a witness Region.
Resources: arn:aws:dsql:region:account-id:cluster/cluster-id Condition Keys: dsql:WitnessRegion (matching the specified witness Region) This permission is checked both in the cluster Region and in the witness Region.
- The witness Region specified in multiRegionProperties.witnessRegion cannot be the same as the cluster's Region.
- When you list peer clusters in multiRegionProperties.clusters, you need dsql:AddPeerCluster for every peer cluster in your request. You need dsql:RemovePeerCluster only for the peer clusters that the update removes.