View a markdown version of this page

Actions, resources, and condition keys for Amazon RDS IAM Authentication - Service Authorization Reference
ActionsResource typesCondition keys

Actions, resources, and condition keys for Amazon RDS IAM Authentication

Amazon RDS IAM Authentication (service prefix: rds-db) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Actions defined by Amazon RDS IAM Authentication

You can specify the following actions in the Action element of an IAM policy statement. For each action, the table lists the resource types and condition keys supported by that action. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions Description Resource types (*required) Condition keys Access level

connect

Grants permission to connect to an RDS database from an IAM role or user

db-user*

aws:ResourceTag/${TagKey}

Permissions management, Write

Resource types defined by Amazon RDS IAM Authentication

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types ARN Condition keys

db-user

arn:${Partition}:rds-db:${Region}:${Account}:dbuser:${DbiResourceId}/${DbUserName}

aws:ResourceTag/${TagKey}

Condition keys for Amazon RDS IAM Authentication

Amazon RDS IAM Authentication defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys Description Type

aws:ResourceTag/${TagKey}

Filters access by the tags associated with the parent RDS DB instance or Aurora DB cluster of the db-user

String