Setting the file. One moment. RDS Db2 Minimal IAM Policy
70
Creating Amazon Aurora Db Cluster With Instances
93
Routing Traffic With Route53 And CloudFront
Resilience Program Design
Creating API Gateway Stage
(opens in a new tab)
assets/rds-db2-minimal-iam-policy.json
JSON·361 lines·9 KB
,
12 "rds:RebootDBInstance",
13 "rds:StartDBInstance",
14 "rds:StopDBInstance",
15 "rds:AddRoleToDBInstance",
16 "rds:RemoveRoleFromDBInstance"
17 ],
18 "Resource": [
19 "arn:aws:rds:*:*:db:*",
20 "arn:aws:rds:*:*:cluster:*"
21 ]
22 },
23 {
24 "Sid": "RDSSnapshotManagement",
25 "Effect": "Allow",
26 "Action": [
27 "rds:CreateDBSnapshot",
28 "rds:DeleteDBSnapshot",
29 "rds:DescribeDBSnapshots",
30 "rds:CopyDBSnapshot",
31 "rds:RestoreDBInstanceFromDBSnapshot",
32 "rds:ModifyDBSnapshotAttribute",
33 "rds:RestoreDBInstanceToPointInTime"
34 ],
35 "Resource": [
36 "arn:aws:rds:*:*:snapshot:*",
37 "arn:aws:rds:*:*:db:*"
38 ]
39 },
40 {
41 "Sid": "RDSReadReplica",
42 "Effect": "Allow",
43 "Action": [
44 "rds:CreateDBInstanceReadReplica",
45 "rds:PromoteReadReplica"
46 ],
47 "Resource": [
48 "arn:aws:rds:*:*:db:*"
49 ]
50 },
51 {
52 "Sid": "RDSParameterGroups",
53 "Effect": "Allow",
54 "Action": [
55 "rds:CreateDBParameterGroup",
56 "rds:ModifyDBParameterGroup",
57 "rds:DeleteDBParameterGroup",
58 "rds:DescribeDBParameterGroups",
59 "rds:DescribeDBParameters",
60 "rds:ResetDBParameterGroup"
61 ],
62 "Resource": [
63 "arn:aws:rds:*:*:pg:*"
64 ]
65 },
66 {
67 "Sid": "RDSOptionGroups",
68 "Effect": "Allow",
69 "Action": [
70 "rds:CreateOptionGroup",
71 "rds:ModifyOptionGroup",
72 "rds:DeleteOptionGroup",
73 "rds:DescribeOptionGroups",
74 "rds:DescribeOptionGroupOptions"
75 ],
76 "Resource": [
77 "arn:aws:rds:*:*:og:*"
78 ]
79 },
80 {
81 "Sid": "RDSSubnetGroups",
82 "Effect": "Allow",
83 "Action": [
84 "rds:CreateDBSubnetGroup",
85 "rds:ModifyDBSubnetGroup",
86 "rds:DeleteDBSubnetGroup",
87 "rds:DescribeDBSubnetGroups"
88 ],
89 "Resource": [
90 "arn:aws:rds:*:*:subgrp:*"
91 ]
92 },
93 {
94 "Sid": "RDSDescribeOperations",
95 "Effect": "Allow",
96 "Action": [
97 "rds:DescribeDBEngineVersions",
98 "rds:DescribeOrderableDBInstanceOptions",
99 "rds:DescribeDBLogFiles",
100 "rds:DownloadDBLogFilePortion",
101 "rds:DescribeEvents",
102 "rds:DescribeEventCategories",
103 "rds:DescribeEventSubscriptions",
104 "rds:DescribeDBClusters",
105 "rds:DescribeDBClusterSnapshots",
106 "rds:DescribeDBClusterParameterGroups",
107 "rds:DescribeDBClusterParameters",
108 "rds:DescribeReservedDBInstances",
109 "rds:DescribeReservedDBInstancesOfferings",
110 "rds:DescribeAccountAttributes",
111 "rds:DescribeCertificates",
112 "rds:DescribeValidDBInstanceModifications"
113 ],
114 "Resource": "*"
115 },
116 {
117 "Sid": "RDSClusterManagement",
118 "Effect": "Allow",
119 "Action": [
120 "rds:CreateDBCluster",
121 "rds:ModifyDBCluster",
122 "rds:DeleteDBCluster",
123 "rds:StartDBCluster",
124 "rds:StopDBCluster",
125 "rds:CreateDBClusterSnapshot",
126 "rds:DeleteDBClusterSnapshot",
127 "rds:RestoreDBClusterFromSnapshot",
128 "rds:RestoreDBClusterToPointInTime"
129 ],
130 "Resource": [
131 "arn:aws:rds:*:*:cluster:*",
132 "arn:aws:rds:*:*:cluster-snapshot:*"
133 ]
134 },
135 {
136 "Sid": "KMSNonResourceActions",
137 "Effect": "Allow",
138 "Action": [
139 "kms:CreateKey",
140 "kms:ListKeys",
141 "kms:ListAliases"
142 ],
143 "Resource": "*"
144 },
145 {
146 "Sid": "KMSKeyManagement",
147 "Effect": "Allow",
148 "Action": [
149 "kms:CreateAlias",
150 "kms:DeleteAlias",
151 "kms:DescribeKey",
152 "kms:CreateGrant",
153 "kms:ListGrants",
154 "kms:RevokeGrant",
155 "kms:GetParametersForImport",
156 "kms:ImportKeyMaterial",
157 "kms:ReplicateKey",
158 "kms:UpdateKeyDescription",
159 "kms:TagResource",
160 "kms:UntagResource",
161 "kms:ListResourceTags"
162 ],
163 "Resource": [
164 "arn:aws:kms:*:*:key/*",
165 "arn:aws:kms:*:*:alias/*"
166 ]
167 },
168 {
169 "Sid": "S3BucketOperations",
170 "Effect": "Allow",
171 "Action": [
172 "s3:CreateBucket",
173 "s3:ListBucket",
174 "s3:GetBucketLocation",
175 "s3:GetBucketVersioning",
176 "s3:PutBucketVersioning",
177 "s3:GetBucketNotification",
178 "s3:PutBucketNotification",
179 "s3:GetBucketPolicy",
180 "s3:PutBucketPolicy",
181 "s3:DeleteBucketPolicy"
182 ],
183 "Resource": [
184 "arn:aws:s3:::*db2*",
185 "arn:aws:s3:::*backup*",
186 "arn:aws:s3:::*restore*",
187 "arn:aws:s3:::*audit*"
188 ]
189 },
190 {
191 "Sid": "S3ObjectOperations",
192 "Effect": "Allow",
193 "Action": [
194 "s3:GetObject",
195 "s3:PutObject",
196 "s3:DeleteObject",
197 "s3:GetObjectVersion",
198 "s3:DeleteObjectVersion",
199 "s3:ListMultipartUploadParts",
200 "s3:AbortMultipartUpload"
201 ],
202 "Resource": [
203 "arn:aws:s3:::*db2*/*",
204 "arn:aws:s3:::*backup*/*",
205 "arn:aws:s3:::*restore*/*",
206 "arn:aws:s3:::*audit*/*"
207 ]
208 },
209 {
210 "Sid": "DirectoryServiceIntegration",
211 "Effect": "Allow",
212 "Action": [
213 "ds:DescribeDirectories",
214 "ds:AuthorizeApplication",
215 "ds:UnauthorizeApplication",
216 "ds:GetDirectoryLimits"
217 ],
218 "Resource": "*"
219 },
220 {
221 "Sid": "IAMRoleForRDS",
222 "Effect": "Allow",
223 "Action": [
224 "iam:CreateRole",
225 "iam:DeleteRole",
226 "iam:GetRole",
227 "iam:ListRolePolicies",
228 "iam:ListAttachedRolePolicies"
229 ],
230 "Resource": [
231 "arn:aws:iam::*:role/rds-*",
232 "arn:aws:iam::*:role/*-rds-*",
233 "arn:aws:iam::*:role/*-db2-*"
234 ]
235 },
236 {
237 "Sid": "IAMPassRoleForRDS",
238 "Effect": "Allow",
239 "Action": [
240 "iam:PassRole"
241 ],
242 "Resource": [
243 "arn:aws:iam::*:role/rds-*",
244 "arn:aws:iam::*:role/*-rds-*",
245 "arn:aws:iam::*:role/*-db2-*"
246 ],
247 "Condition": {
248 "StringEquals": {
249 "iam:PassedToService": [
250 "rds.amazonaws.com",
251 "monitoring.rds.amazonaws.com"
252 ]
253 }
254 }
255 },
256 {
257 "Sid": "IAMAttachPolicyForRDS",
258 "Effect": "Allow",
259 "Action": [
260 "iam:AttachRolePolicy",
261 "iam:DetachRolePolicy"
262 ],
263 "Resource": [
264 "arn:aws:iam::*:role/rds-*",
265 "arn:aws:iam::*:role/*-rds-*",
266 "arn:aws:iam::*:role/*-db2-*"
267 ],
268 "Condition": {
269 "ArnLike": {
270 "iam:PolicyARN": [
271 "arn:aws:iam::*:policy/rds-*",
272 "arn:aws:iam::*:policy/*-rds-*",
273 "arn:aws:iam::*:policy/*-db2-*",
274 "arn:aws:iam::aws:policy/service-role/AmazonRDSEnhancedMonitoringRole"
275 ]
276 }
277 }
278 },
279 {
280 "Sid": "EnhancedMonitoring",
281 "Effect": "Allow",
282 "Action": [
283 "logs:CreateLogGroup",
284 "logs:CreateLogStream",
285 "logs:PutLogEvents",
286 "logs:DescribeLogGroups",
287 "logs:DescribeLogStreams"
288 ],
289 "Resource": [
290 "arn:aws:logs:*:*:log-group:RDSOSMetrics*",
291 "arn:aws:logs:*:*:log-group:/aws/rds/*"
292 ]
293 },
294 {
295 "Sid": "SNSNotifications",
296 "Effect": "Allow",
297 "Action": [
298 "sns:CreateTopic",
299 "sns:DeleteTopic",
300 "sns:Subscribe",
301 "sns:Unsubscribe",
302 "sns:Publish",
303 "sns:ListTopics",
304 "sns:ListSubscriptions",
305 "sns:GetTopicAttributes",
306 "sns:SetTopicAttributes"
307 ],
308 "Resource": [
309 "arn:aws:sns:*:*:rds-*",
310 "arn:aws:sns:*:*:*-rds-*",
311 "arn:aws:sns:*:*:*-db2-*"
312 ]
313 },
314 {
315 "Sid": "EventSubscriptions",
316 "Effect": "Allow",
317 "Action": [
318 "rds:CreateEventSubscription",
319 "rds:ModifyEventSubscription",
320 "rds:DeleteEventSubscription"
321 ],
322 "Resource": [
323 "arn:aws:rds:*:*:es:*"
324 ]
325 },
326 {
327 "Sid": "VPCNetworking",
328 "Effect": "Allow",
329 "Action": [
330 "ec2:DescribeVpcs",
331 "ec2:DescribeSubnets",
332 "ec2:DescribeSecurityGroups",
333 "ec2:DescribeAvailabilityZones",
334 "ec2:CreateSecurityGroup",
335 "ec2:AuthorizeSecurityGroupIngress",
336 "ec2:AuthorizeSecurityGroupEgress",
337 "ec2:RevokeSecurityGroupIngress",
338 "ec2:RevokeSecurityGroupEgress"
339 ],
340 "Resource": "*"
341 },
342 {
343 "Sid": "ResourceTagging",
344 "Effect": "Allow",
345 "Action": [
346 "rds:AddTagsToResource",
347 "rds:RemoveTagsFromResource",
348 "rds:ListTagsForResource"
349 ],
350 "Resource": [
351 "arn:aws:rds:*:*:db:*",
352 "arn:aws:rds:*:*:snapshot:*",
353 "arn:aws:rds:*:*:pg:*",
354 "arn:aws:rds:*:*:og:*",
355 "arn:aws:rds:*:*:subgrp:*",
356 "arn:aws:rds:*:*:cluster:*",
357 "arn:aws:rds:*:*:cluster-snapshot:*"
358 ]
359 }
360 ]
361}