Adding and editing resource-based policies for clusters - Amazon Aurora DSQL

Adding and editing resource-based policies for clusters

To add a resource-based policy to an existing cluster

  1. Sign in to the AWS Management Console and open the Aurora DSQL console at https://console.aws.amazon.com/dsql/.

  2. Choose your cluster from the cluster list to open the cluster details page.

  3. Choose the Permissions tab.

  4. In the Resource-based policy section, choose Add policy.

  5. Enter your policy document in the JSON editor. You can use Edit statement or Add new statement to build your policy.

  6. Choose Add policy.

To edit an existing resource-based policy

  1. Sign in to the AWS Management Console and open the Aurora DSQL console at https://console.aws.amazon.com/dsql/.

  2. Choose your cluster from the cluster list to open the cluster details page.

  3. Choose the Permissions tab.

  4. In the Resource-based policy section, choose Edit.

  5. Modify the policy document in the JSON editor. You can use Edit statement or Add new statement to update your policy.

  6. Choose Save changes.

Use the put-cluster-policy command to attach a new policy or update an existing policy on a cluster:

aws dsql put-cluster-policy --identifier your_cluster_id --policy '{
    "Version": "2012-10-17",		 	 	 
    "Statement": [{
        "Effect": "Deny",
        "Principal": {"AWS": "*"},
        "Resource": "*",
        "Action": ["dsql:DbConnect", "dsql:DbConnectAdmin"],
        "Condition": { 
            "Null": { "aws:SourceVpc": "true" } 
        }
    }]
}'
Python

import boto3
import json

client = boto3.client('dsql')

policy = {
    "Version": "2012-10-17",		 	 	 
    "Statement": [{
        "Effect": "Deny",
        "Principal": {"AWS": "*"},
        "Resource": "*",
        "Action": ["dsql:DbConnect", "dsql:DbConnectAdmin"],
        "Condition": {
            "Null": {"aws:SourceVpc": "true"}
        }
    }]
}

response = client.put_cluster_policy(
    identifier='your_cluster_id',
    policy=json.dumps(policy)
)
Java

import software.amazon.awssdk.services.dsql.DsqlClient;
import software.amazon.awssdk.services.dsql.model.PutClusterPolicyRequest;

DsqlClient client = DsqlClient.create();

String policy = """
{
  "Version": "2012-10-17",		 	 	 
  "Statement": [{
    "Effect": "Deny",
    "Principal": {"AWS": "*"},
    "Resource": "*",
    "Action": ["dsql:DbConnect", "dsql:DbConnectAdmin"],
    "Condition": {
      "Null": {"aws:SourceVpc": "true"}
    }
  }]
}
""";

PutClusterPolicyRequest request = PutClusterPolicyRequest.builder()
    .identifier("your_cluster_id")
    .policy(policy)
    .build();

client.putClusterPolicy(request);