CODEWITHSUNDEEP
amazon-web-servicesamazon-iamrds
Chalaka Salpadoru
Chalaka Salpadoru

Reputation: 117

Allowing AWS IAM users create RDS instances

I want to allow my AWS IAM user to be able to create RDS instances via AWS UI. So added the policy below

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": "rds:*",
        "Resource": "*"
    }
]}

While users can get in to "Specify DB details" page, when all information is provided and "Next" clicked, I get the following error:

Currently retrieving account attributes We are currently in the process of retrieving your account attributes. Please try again in a few minutes.

enter image description here Please advise.

Upvotes: 2

Views: 2581

Answers (1)

kichik
kichik

Reputation: 34704

According to the documentation:

For a user to work with the Amazon RDS console, that user must have a minimum set of permissions. These permissions allow the user to describe the Amazon RDS resources for their AWS account and to provide other related information, including Amazon EC2 security and network information.

So you seem to be missing some EC2 and network permissions.

The same document suggests using the predefined policies AmazonRDSReadOnlyAccess or AmazonRDSFullAccess. The latter is defined as:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "rds:*",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetMetricStatistics",
                "ec2:DescribeAccountAttributes",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcAttribute",
                "ec2:DescribeVpcs",
                "sns:ListSubscriptions",
                "sns:ListTopics",
                "sns:Publish",
                "logs:DescribeLogStreams",
                "logs:GetLogEvents"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Action": "pi:*",
            "Effect": "Allow",
            "Resource": "arn:aws:pi:*:*:metrics/rds/*"
        },
        {
            "Action": "iam:CreateServiceLinkedRole",
            "Effect": "Allow",
            "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS",
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "rds.amazonaws.com"
                }
            }
        }
    ]
}

Upvotes: 3

Related Questions