Integrating an Amazon RDS for Db2 DB instance with Amazon S3

Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

In the navigation pane, choose Policies.

Choose Create policy, and then choose JSON.

Add actions by service. To transfer files from an Amazon S3 bucket to Amazon RDS, you must select bucket permissions and object permissions.

Expand Resources. You must specify your bucket and object resources.

Choose Next.

For Policy name, enter a name for this policy.

(Optional) For Description, enter a description for this policy.

Choose Create policy.

Run the create-policy command. In the following example, replace iam_policy_name and s3_bucket_name with a name for your IAM policy and the name of the Amazon S3 bucket where your RDS for Db2 database resides.

For Linux, macOS, or Unix:

aws iam create-policy \
    --policy-name iam_policy_name \
    --policy-document '{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "kms:GenerateDataKey",
            "kms:Decrypt",
            "s3:PutObject",
            "s3:GetObject",
            "s3:AbortMultipartUpload",
            "s3:ListBucket",
            "s3:DeleteObject",
            "s3:GetObjectVersion",
            "s3:ListMultipartUploadParts"
          ],
          "Resource": [
            "arn:aws:s3:::s3_bucket_name/*",
            "arn:aws:s3:::s3_bucket_name"
          ]
        }
      ]
    }'

For Windows:

aws iam create-policy ^
    --policy-name iam_policy_name ^
    --policy-document '{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
            "Action": [
              "s3:PutObject",
              "s3:GetObject",
              "s3:AbortMultipartUpload",
              "s3:ListBucket",
              "s3:DeleteObject",
              "s3:GetObjectVersion",
              "s3:ListMultipartUploadParts"
            ],
            "Resource": [
              "arn:aws:s3:::s3_bucket_name/*",
              "arn:aws:s3:::s3_bucket_name"
            ]
        }
      ]
    }'

After the policy is created, note the ARN of the policy. You need the ARN for Step 2: Create an IAM role and attach your IAM policy.

Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

In the navigation pane, choose Roles.

Choose Create role.

For Trusted entity type, select Amazon Web Service.

For Service or use case, select RDS, and then select RDS – Add Role to Database.

Choose Next.

For Permissions policies, search for and select the name of the IAM policy that you created.

Choose Next.

For Role name, enter a role name.

(Optional) For Description, enter a description for the new role.

Choose Create role.

Run the create-role command. In the following example, replace iam_role_name with a name for your IAM role.

For Linux, macOS, or Unix:

aws iam create-role \
    --role-name iam_role_name \
    --assume-role-policy-document '{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Service": "rds.amazonaws.com"
          },
          "Action": "sts:AssumeRole"
        }
      ]
    }'

For Windows:

aws iam create-role ^
    --role-name iam_role_name ^
    --assume-role-policy-document '{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Service": "rds.amazonaws.com"
          },
          "Action": "sts:AssumeRole"
        }
      ]
    }'

After the role is created, note the ARN of the role. You need the ARN for Step 3: Add your IAM role to your RDS for Db2 DB instance.

Run the attach-role-policy command. In the following example, replace iam_policy_arn with the ARN of the IAM policy that you created in Step 1: Create an IAM policy. Replace iam_role_name with the name of the IAM role that you just created.

For Linux, macOS, or Unix:

aws iam attach-role-policy \
   --policy-arn iam_policy_arn \
   --role-name iam_role_name

For Windows:

aws iam attach-role-policy ^
   --policy-arn iam_policy_arn ^
   --role-name iam_role_name

Sign in to the Amazon Web Services Management Console and open the Amazon RDS console at https://console.amazonaws.cn/rds/.

In the navigation pane, choose Databases.

Choose your RDS for Db2 DB instance name.

On the Connectivity & security tab, scroll down to the Manage IAM roles section at the bottom of the page.

For Add IAM roles to this instance, choose the role that you created in Step 2: Create an IAM role and attach your IAM policy.

For Feature, choose S3_INTEGRATION.

Choose Add role.