Amazon RDS:允許標籤持有者擁有對已標記的 RDS 資源的完整存取權限 - AWS Identity and Access Management

Amazon RDS:允許標籤持有者擁有對已標記的 RDS 資源的完整存取權限

此範例會示範如何建立身分型政策,允許標籤擁有者完整存取他們已加上標籤的 RDS 資源。此政策僅會授予從 AWS API 或 AWS CLI 以程式設計方式完成此動作的必要許可。

{ "Version": "2012-10-17", "Statement": [ { "Action": [ "rds:Describe*", "rds:List*" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "rds:DeleteDBInstance", "rds:RebootDBInstance", "rds:ModifyDBInstance" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": {"rds:db-tag/Owner": "${aws:username}"} } }, { "Action": [ "rds:ModifyOptionGroup", "rds:DeleteOptionGroup" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": {"rds:og-tag/Owner": "${aws:username}"} } }, { "Action": [ "rds:ModifyDBParameterGroup", "rds:ResetDBParameterGroup" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": {"rds:pg-tag/Owner": "${aws:username}"} } }, { "Action": [ "rds:AuthorizeDBSecurityGroupIngress", "rds:RevokeDBSecurityGroupIngress", "rds:DeleteDBSecurityGroup" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": {"rds:secgrp-tag/Owner": "${aws:username}"} } }, { "Action": [ "rds:DeleteDBSnapshot", "rds:RestoreDBInstanceFromDBSnapshot" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": {"rds:snapshot-tag/Owner": "${aws:username}"} } }, { "Action": [ "rds:ModifyDBSubnetGroup", "rds:DeleteDBSubnetGroup" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": {"rds:subgrp-tag/Owner": "${aws:username}"} } }, { "Action": [ "rds:ModifyEventSubscription", "rds:AddSourceIdentifierToSubscription", "rds:RemoveSourceIdentifierFromSubscription", "rds:DeleteEventSubscription" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEqualsIgnoreCase": {"rds:es-tag/Owner": "${aws:username}"} } } ] }