Setting the file. One moment.
Create Db2 Audit Role · RDS Db2 · aws/agent-toolkit-for-aws · Skills Docs
Repo No. 14 · RDS Db2
↖ Back to the coverEnd User Computing Skills
Messaging And Streaming Skills
Migration And Modernization Skills
Networking And Content Delivery Skills
Security And Identity Skills
Web And Mobile Development
132 skills · 818 min
Back to the top of the page 70
Creating Amazon Aurora Db Cluster With Instances
93
Routing Traffic With Route53 And CloudFront
Resilience Program Design
Creating API Gateway Stage
(opens in a new tab)
scripts/ create-db2-audit-role.sh
Shell · 127 lines · 5 KB
14 # Db2 instance in this account/region)
15 # MAJOR_ENGINE_VERSION Db2 major engine version for the option group (default: 11.5)
16 # =============================================================================
17
18 policy_name = "db2-audit-policy"
19 role_name = "db2-audit-role"
20 audit_bucket_name = "${ AUDIT_BUCKET_NAME :- rds-db2-enablement }"
21 region = "${ REGION :- ${ AWS_REGION :- us-east-1 }}"
22 major_engine_version = "${ MAJOR_ENGINE_VERSION :- 11 . 5 }"
23 instance_id = "${ DB_INSTANCE_ID :-* }"
24
25 # Account ID is computed once, up front, so it can be interpolated safely
26 # (command substitution does NOT expand inside single-quoted strings).
27 account_id = "$( aws sts get-caller-identity --query Account --output text)"
28
29 # KMS key used for the audit bucket's SSE-KMS encryption. Scope kms:Decrypt /
30 # kms:GenerateDataKey to THIS key only (least privilege) rather than "*".
31 # Replace the placeholder, or export AUDIT_KMS_KEY_ARN before running.
32 audit_kms_key_arn = "${ AUDIT_KMS_KEY_ARN :- arn : aws : kms : ${ region } : ${ account_id } : key / REPLACE-WITH-AUDIT-BUCKET-KMS-KEY-ID }"
33
34 # --- Permissions policy (heredoc → variables expand) ---
35 policy_document = $( cat << EOF
36 {
37 "Version": "2012-10-17",
38 "Statement": [
39 {
40 "Sid": "Statement1",
41 "Effect": "Allow",
42 "Action": ["s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation"],
43 "Resource": ["arn:aws:s3:::${ audit_bucket_name }"]
44 },
45 {
46 "Sid": "Statement2",
47 "Effect": "Allow",
48 "Action": ["s3:PutObject", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload"],
49 "Resource": ["arn:aws:s3:::${ audit_bucket_name }/*"]
50 },
51 {
52 "Sid": "Statement3",
53 "Effect": "Allow",
54 "Action": ["s3:ListAllMyBuckets"],
55 "Resource": ["*"]
56 },
57 {
58 "Sid": "Statement4KmsScopedToAuditBucketKey",
59 "Effect": "Allow",
60 "Action": ["kms:GenerateDataKey", "kms:Decrypt"],
61 "Resource": ["${ audit_kms_key_arn }"]
62 }
63 ]
64 }
65 EOF
66 )
67
68 # --- Trust policy with confused-deputy protection (aws:SourceAccount / aws:SourceArn) ---
69 trust_policy = $( cat << EOF
70 {
71 "Version": "2012-10-17",
72 "Statement": [
73 {
74 "Effect": "Allow",
75 "Principal": { "Service": "rds.amazonaws.com" },
76 "Action": "sts:AssumeRole",
77 "Condition": {
78 "StringEquals": { "aws:SourceAccount": "${ account_id }" },
79 "ArnLike": { "aws:SourceArn": "arn:aws:rds:${ region }:${ account_id }:db:${ instance_id }" }
80 }
81 }
82 ]
83 }
84 EOF
85 )
86
87 # --- Create the IAM policy and capture its ARN directly from the create call ---
88 # (aws iam get-policy requires --policy-arn, not --policy-name, so we capture the
89 # ARN from create-policy output instead of a follow-up get-policy.)
90 IAM_POLICY_ARN = $( aws iam create-policy \
91 --policy-name " $policy_name " \
92 --policy-document " $policy_document " \
93 --query 'Policy.Arn' --output text )
94
95 # --- Create the IAM role with the confused-deputy-protected trust policy ---
96 aws iam create-role \
97 --role-name " $role_name " \
98 --assume-role-policy-document " $trust_policy "
99
100 # --- Attach the policy to the role ---
101 aws iam attach-role-policy \
102 --policy-arn " $IAM_POLICY_ARN " \
103 --role-name " $role_name "
104
105 # --- Create the option group for DB2 audit ---
106 aws rds create-option-group \
107 --engine-name db2 \
108 --major-engine-version " $major_engine_version " \
109 --option-group-description "Option group for DB2 audit" \
110 --option-group-name "db2-audit-option-group"
111
112 # --- Add the DB2_AUDIT option (account_id expanded via heredoc, not single quotes) ---
113 option_settings = $( cat << EOF
114 [{
115 "OptionName": "DB2_AUDIT",
116 "OptionSettings": [
117 {"Name": "IAM_ROLE_ARN", "Value": "arn:aws:iam::${ account_id }:role/${ role_name }"},
118 {"Name": "S3_BUCKET_NAME", "Value": "${ audit_bucket_name }"}
119 ]
120 }]
121 EOF
122 )
123
124 aws rds add-option-to-option-group \
125 --option-group-name "db2-audit-option-group" \
126 --options " $option_settings " \
127 --apply-immediately