Product logo
DocsBlogPricing

Permissions for @turbot/aws-rds

Taking a look at permissions and associated grant levels for each permission for RDS:

PermissionGrant LevelHelp
cloudwatch:DescribeAlarmsMetadatahttp://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAM.html
cloudwatch:GetMetricDataMetadata
cloudwatch:GetMetricStatisticsMetadatahttp://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAM.html
dbqms:CreateFavoriteQueryAdmin
dbqms:CreateQueryHistoryAdmin
dbqms:CreateTabAdmin
dbqms:DeleteFavoriteQueriesAdmin
dbqms:DeleteQueryHistoryAdmin
dbqms:DeleteTabAdmin
dbqms:DescribeFavoriteQueriesMetadata
dbqms:DescribeQueryHistoryMetadata
dbqms:DescribeTabsMetadata
dbqms:GetQueryStringMetadata
dbqms:UpdateFavoriteQueryAdmin
dbqms:UpdateQueryHistoryAdmin
dbqms:UpdateTabAdmin
ec2:DescribeAccountAttributesMetadatahttp://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAM.html
ec2:DescribeAvailabilityZonesMetadatahttp://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAM.html
ec2:DescribeSecurityGroupsMetadatahttp://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAM.html
ec2:DescribeSubnetsMetadatahttp://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAM.html
ec2:DescribeVpcsMetadatahttp://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAM.html
iam:ListRolesMetadata
iam:PassRoleAdminRequired to attach rds-monitoring-role while creating new rds clusters.
kms:ListAliasesMetadata
pi:CreatePerformanceAnalysisReportAdminPerformance Insights
pi:DeletePerformanceAnalysisReportAdmin
pi:DescribeDimensionKeysMetadata
pi:GetDimensionKeyDetailsMetadata
pi:GetPerformanceAnalysisReportMetadata
pi:GetResourceMetadataMetadata
pi:GetResourceMetricsMetadata
pi:ListAvailableResourceDimensionsMetadata
pi:ListAvailableResourceMetricsMetadata
pi:ListPerformanceAnalysisReportsMetadata
pi:ListTagsForResourceMetadata
pi:TagResourceOperator
pi:UntagResourceOperator
ram:GetResourceSharesMetadata
ram:ListResourcesMetadata
rds-data:BatchExecuteStatementAdmin
rds-data:BeginTransactionAdmin
rds-data:CommitTransactionAdmin
rds-data:ExecuteSqlAdmin
rds-data:ExecuteStatementAdmin
rds-data:RollbackTransactionAdmin
rds-db:connectAdmin
rds:AddRoleToDBClusterAdmin
rds:AddRoleToDBInstanceAdmin
rds:AddSourceIdentifierToSubscriptionOperator
rds:AddTagsToResourceOperator
rds:ApplyPendingMaintenanceActionOperator
rds:AuthorizeDBSecurityGroupIngressAdminYou can't authorize ingress from an EC2 security group in one AWS Region to an Amazon RDS DB instance in another. You can't authorize ingress from a VPC security group in one VPC to an Amazon RDS DB instance in another.
rds:BacktrackDBClusterAdmin
rds:CancelExportTaskAdmin
rds:CopyDBClusterParameterGroupAdmin
rds:CopyDBClusterSnapshotOperator
rds:CopyDBParameterGroupAdmin
rds:CopyDBSnapshotOperator
rds:CopyOptionGroupAdmin
rds:CreateCustomAvailabilityZoneAdmin
rds:CreateCustomDBEngineVersionAdmin
rds:CreateDBClusterAdmin
rds:CreateDBClusterEndpointAdmin
rds:CreateDBClusterParameterGroupAdmin
rds:CreateDBClusterSnapshotOperator
rds:CreateDBInstanceAdmin
rds:CreateDBInstanceReadReplicaAdmin
rds:CreateDBParameterGroupAdmin
rds:CreateDBProxyAdmin
rds:CreateDBProxyEndpointAdmin
rds:CreateDBSecurityGroupAdminAdmin can manage DB security group controls access to EC2-Classic DB instances that are not in a VPC.
rds:CreateDBSnapshotOperator
rds:CreateDBSubnetGroupWhitelistPermission controlled by AWS > RDS > Subnet Group Management
rds:CreateEventSubscriptionOperator
rds:CreateGlobalClusterAdmin
rds:CreateOptionGroupAdmin
rds:CrossRegionCommunicationAdmin
rds:DeleteCustomAvailabilityZoneAdmin
rds:DeleteCustomDBEngineVersionAdmin
rds:DeleteDBClusterAdmin
rds:DeleteDBClusterEndpointAdmin
rds:DeleteDBClusterParameterGroupAdmin
rds:DeleteDBClusterSnapshotAdminDeletion of snapshots is limited to Admins even though Operators can create them.
rds:DeleteDBInstanceAdmin
rds:DeleteDBInstanceAutomatedBackupAdminAdmins can delete automated backups based on the source instance's DbiResourceId value or the restorable instance's resource ID.
rds:DeleteDBParameterGroupAdmin
rds:DeleteDBProxyAdmin
rds:DeleteDBProxyEndpointAdmin
rds:DeleteDBSecurityGroupAdmin
rds:DeleteDBSnapshotAdminDeletion of snapshots is limited to Admins even though Operators can create them.
rds:DeleteDBSubnetGroupWhitelistPermission controlled by AWS > RDS > Subnet Group Management
rds:DeleteEventSubscriptionOperator
rds:DeleteGlobalClusterAdmin
rds:DeleteInstallationMediaAdmin
rds:DeleteOptionGroupAdmin
rds:DeregisterDBProxyTargetsAdmin
rds:DescribeAccountAttributesMetadata
rds:DescribeCertificatesMetadata
rds:DescribeCustomAvailabilityZonesMetadata
rds:DescribeDBClusterBacktracksMetadata
rds:DescribeDBClusterEndpointsMetadata
rds:DescribeDBClusterParameterGroupsMetadata
rds:DescribeDBClusterParametersMetadata
rds:DescribeDBClustersMetadata
rds:DescribeDBClusterSnapshotAttributesMetadata
rds:DescribeDBClusterSnapshotsMetadata
rds:DescribeDBEngineVersionsMetadata
rds:DescribeDBInstanceAutomatedBackupsMetadata
rds:DescribeDBInstancesMetadata
rds:DescribeDBLogFilesMetadata
rds:DescribeDBParameterGroupsMetadata
rds:DescribeDBParametersMetadata
rds:DescribeDBProxiesMetadata
rds:DescribeDBProxyEndpointsMetadata
rds:DescribeDBProxyTargetGroupsMetadata
rds:DescribeDBProxyTargetsMetadata
rds:DescribeDBSecurityGroupsMetadata
rds:DescribeDBSnapshotAttributesMetadata
rds:DescribeDBSnapshotsMetadata
rds:DescribeDBSubnetGroupsMetadata
rds:DescribeEngineDefaultClusterParametersMetadata
rds:DescribeEngineDefaultParametersMetadata
rds:DescribeEventCategoriesMetadata
rds:DescribeEventsMetadata
rds:DescribeEventSubscriptionsMetadata
rds:DescribeExportTasksMetadata
rds:DescribeGlobalClustersMetadata
rds:DescribeInstallationMediaMetadata
rds:DescribeOptionGroupOptionsMetadata
rds:DescribeOptionGroupsMetadata
rds:DescribeOrderableDBInstanceOptionsMetadata
rds:DescribePendingMaintenanceActionsMetadata
rds:DescribeRecommendationGroupsMetadata
rds:DescribeRecommendationsMetadata
rds:DescribeReservedDBInstancesMetadata
rds:DescribeReservedDBInstancesOfferingsMetadata
rds:DescribeSourceRegionsMetadata
rds:DescribeValidDBInstanceModificationsMetadata
rds:DownloadCompleteDBLogFileReadOnly
rds:DownloadDBLogFilePortionReadOnly
rds:FailoverDBClusterOperator
rds:FailoverGlobalClusterOperator
rds:ImportInstallationMediaAdmin
rds:ListTagsForResourceMetadata
rds:ModifyCertificatesAdmin
rds:ModifyCurrentDBClusterCapacityAdminAdmins can set the capacity of an Aurora Serverless DB cluster to a specific value.
rds:ModifyCustomDBEngineVersionAdmin
rds:ModifyDBClusterAdmin
rds:ModifyDBClusterEndpointAdminAdmins can modify the properties of an endpoint in an Amazon Aurora DB cluster.
rds:ModifyDBClusterParameterGroupAdmin
rds:ModifyDBClusterSnapshotAttributeAdminAllows for cross-account access.
rds:ModifyDBInstanceAdmin
rds:ModifyDBParameterGroupAdmin
rds:ModifyDBProxyAdmin
rds:ModifyDBProxyEndpointAdmin
rds:ModifyDBProxyTargetGroupAdmin
rds:ModifyDBSnapshotOperatorCan update a manual DB snapshot's engine version. Currently only supports MySQL.
rds:ModifyDBSnapshotAttributeAdminAllows for cross-account access.
rds:ModifyDBSubnetGroupWhitelistPermission controlled by AWS > RDS > Subnet Group Management
rds:ModifyEventSubscriptionOperator
rds:ModifyGlobalClusterAdmin
rds:ModifyOptionGroupAdmin
rds:ModifyRecommendationAdmin
rds:PromoteReadReplicaOperator
rds:PromoteReadReplicaDBClusterOperator
rds:PurchaseReservedDBInstancesOfferingOwner
rds:RebootDBClusterOperator
rds:RebootDBInstanceOperator
rds:RegisterDBProxyTargetsAdmin
rds:RemoveFromGlobalClusterAdmin
rds:RemoveRoleFromDBClusterAdmin
rds:RemoveRoleFromDBInstanceAdmin
rds:RemoveSourceIdentifierFromSubscriptionOperator
rds:RemoveTagsFromResourceOperator
rds:ResetDBClusterParameterGroupAdmin
rds:ResetDBParameterGroupAdmin
rds:RestoreDBClusterFromS3Admin
rds:RestoreDBClusterFromSnapshotAdmin
rds:RestoreDBClusterToPointInTimeAdmin
rds:RestoreDBInstanceFromDBSnapshotAdmin
rds:RestoreDBInstanceFromS3AdminAdmin can create backup of there database and store it in s3.
rds:RestoreDBInstanceToPointInTimeAdmin
rds:RevokeDBSecurityGroupIngressAdmin
rds:StartActivityStreamOperator
rds:StartDBClusterOperator
rds:StartDBInstanceOperator
rds:StartDBInstanceAutomatedBackupsReplicationOperator
rds:StartExportTaskOperator
rds:StopActivityStreamOperator
rds:StopDBClusterOperator
rds:StopDBInstanceOperator
rds:StopDBInstanceAutomatedBackupsReplicationOperator