Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon RDS

Amazon RDS (service prefix: rds) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon RDS

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
AddSourceIdentifierToSubscription	docdb	rds:AddSourceIdentifierToSubscription			Write
AddTagsToResource	docdb	rds:AddTagsToResource			Tagging, Write
ApplyPendingMaintenanceAction	docdb	rds:ApplyPendingMaintenanceAction			Write
CopyDBClusterParameterGroup	docdb	rds:AddTagsToResource			Tagging, Write
CopyDBClusterParameterGroup	docdb	rds:CopyDBClusterParameterGroup			Write
CopyDBClusterSnapshot	docdb	rds:AddTagsToResource			Tagging, Write
CopyDBClusterSnapshot	docdb	rds:CopyDBClusterSnapshot			Write
CreateDBCluster	docdb	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBCluster			Write
		rds:CreateDBInstance			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
CreateDBClusterParameterGroup	docdb	rds:AddTagsToResource			Tagging, Write
CreateDBClusterParameterGroup	docdb	rds:CreateDBClusterParameterGroup			Write
CreateDBClusterSnapshot	docdb	rds:AddTagsToResource			Tagging, Write
CreateDBClusterSnapshot	docdb	rds:CreateDBClusterSnapshot			Write
CreateDBInstance	docdb	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBInstance			Write
		rds:CreateTenantDatabase			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
CreateDBSubnetGroup	docdb	rds:AddTagsToResource			Tagging, Write
CreateDBSubnetGroup	docdb	rds:CreateDBSubnetGroup			Write
CreateEventSubscription	docdb	rds:AddTagsToResource			Tagging, Write
CreateEventSubscription	docdb	rds:CreateEventSubscription			Write
CreateGlobalCluster	docdb	rds:AddTagsToResource			Tagging, Write
CreateGlobalCluster	docdb	rds:CreateGlobalCluster			Write
DeleteDBCluster	docdb	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBClusterSnapshot			Write
		rds:DeleteDBCluster			Write
		rds:DeleteDBInstance			Write
DeleteDBClusterParameterGroup	docdb	rds:DeleteDBClusterParameterGroup			Write
DeleteDBClusterSnapshot	docdb	rds:DeleteDBClusterSnapshot			Write
DeleteDBInstance	docdb	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBSnapshot			Write
		rds:DeleteDBInstance			Write
		rds:DeleteTenantDatabase			Write
DeleteDBSubnetGroup	docdb	rds:DeleteDBSubnetGroup			Write
DeleteEventSubscription	docdb	rds:DeleteEventSubscription			Write
DeleteGlobalCluster	docdb	rds:DeleteGlobalCluster			Write
DescribeCertificates	docdb	rds:DescribeCertificates			List
DescribeDBClusterParameterGroups	docdb	rds:DescribeDBClusterParameterGroups			List
DescribeDBClusterParameters	docdb	rds:DescribeDBClusterParameters			List
DescribeDBClusterSnapshotAttributes	docdb	rds:DescribeDBClusterSnapshotAttributes			List
DescribeDBClusterSnapshots	docdb	rds:DescribeDBClusterSnapshots			List
DescribeDBClusters	docdb	rds:DescribeDBClusters			List
DescribeDBEngineVersions	docdb	rds:DescribeDBEngineVersions			List
DescribeDBInstances	docdb	rds:DescribeDBInstances			List
DescribeDBSubnetGroups	docdb	rds:DescribeDBSubnetGroups			List
DescribeEngineDefaultClusterParameters	docdb	rds:DescribeEngineDefaultClusterParameters			List
DescribeEventCategories	docdb	rds:DescribeEventCategories			List
DescribeEventSubscriptions	docdb	rds:DescribeEventSubscriptions			List
DescribeEvents	docdb	rds:DescribeEvents			List
DescribeGlobalClusters	docdb	rds:DescribeGlobalClusters			List
DescribeOrderableDBInstanceOptions	docdb	rds:DescribeOrderableDBInstanceOptions			List
DescribePendingMaintenanceActions	docdb	rds:DescribePendingMaintenanceActions			List
FailoverDBCluster	docdb	rds:FailoverDBCluster			Write
FailoverGlobalCluster	docdb	rds:FailoverGlobalCluster			Write
ListTagsForResource	docdb	rds:ListTagsForResource			Read
ModifyDBCluster	docdb	rds:ModifyDBCluster			Write
		rds:ModifyDBInstance			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
ModifyDBClusterParameterGroup	docdb	rds:ModifyDBClusterParameterGroup			Write
ModifyDBClusterSnapshotAttribute	docdb	rds:ModifyDBClusterSnapshotAttribute			Write
ModifyDBInstance	docdb	rds:ModifyDBInstance			Write
ModifyDBInstance	docdb	iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
ModifyDBSubnetGroup	docdb	rds:ModifyDBSubnetGroup			Write
ModifyEventSubscription	docdb	rds:ModifyEventSubscription			Write
ModifyGlobalCluster	docdb	rds:ModifyGlobalCluster			Write
RebootDBInstance	docdb	rds:RebootDBInstance			Write
RemoveFromGlobalCluster	docdb	rds:RemoveFromGlobalCluster			Write
RemoveSourceIdentifierFromSubscription	docdb	rds:RemoveSourceIdentifierFromSubscription			Write
RemoveTagsFromResource	docdb	rds:RemoveTagsFromResource			Tagging, Write
ResetDBClusterParameterGroup	docdb	rds:ResetDBClusterParameterGroup			Write
RestoreDBClusterFromSnapshot	docdb	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBInstance			Write
		rds:RestoreDBClusterFromSnapshot			Write
		iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
RestoreDBClusterToPointInTime	docdb	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBInstance			Write
		rds:RestoreDBClusterToPointInTime			Write
		iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
StartDBCluster	docdb	rds:StartDBCluster			Write
StopDBCluster	docdb	rds:StopDBCluster			Write
SwitchoverGlobalCluster	docdb	rds:SwitchoverGlobalCluster			Write
AddRoleToDBCluster	neptune	rds:AddRoleToDBCluster			Write
AddRoleToDBCluster	neptune	iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
AddSourceIdentifierToSubscription	neptune	rds:AddSourceIdentifierToSubscription			Write
AddTagsToResource	neptune	rds:AddTagsToResource			Tagging, Write
ApplyPendingMaintenanceAction	neptune	rds:ApplyPendingMaintenanceAction			Write
CopyDBClusterParameterGroup	neptune	rds:AddTagsToResource			Tagging, Write
CopyDBClusterParameterGroup	neptune	rds:CopyDBClusterParameterGroup			Write
CopyDBClusterSnapshot	neptune	rds:AddTagsToResource			Tagging, Write
CopyDBClusterSnapshot	neptune	rds:CopyDBClusterSnapshot			Write
CopyDBParameterGroup	neptune	rds:AddTagsToResource			Tagging, Write
CopyDBParameterGroup	neptune	rds:CopyDBParameterGroup			Write
CreateDBCluster	neptune	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBCluster			Write
		rds:CreateDBInstance			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
CreateDBClusterEndpoint	neptune	rds:AddTagsToResource			Tagging, Write
CreateDBClusterEndpoint	neptune	rds:CreateDBClusterEndpoint			Write
CreateDBClusterParameterGroup	neptune	rds:AddTagsToResource			Tagging, Write
CreateDBClusterParameterGroup	neptune	rds:CreateDBClusterParameterGroup			Write
CreateDBClusterSnapshot	neptune	rds:AddTagsToResource			Tagging, Write
CreateDBClusterSnapshot	neptune	rds:CreateDBClusterSnapshot			Write
CreateDBInstance	neptune	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBInstance			Write
		rds:CreateTenantDatabase			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
CreateDBParameterGroup	neptune	rds:AddTagsToResource			Tagging, Write
CreateDBParameterGroup	neptune	rds:CreateDBParameterGroup			Write
CreateDBSubnetGroup	neptune	rds:AddTagsToResource			Tagging, Write
CreateDBSubnetGroup	neptune	rds:CreateDBSubnetGroup			Write
CreateEventSubscription	neptune	rds:AddTagsToResource			Tagging, Write
CreateEventSubscription	neptune	rds:CreateEventSubscription			Write
CreateGlobalCluster	neptune	rds:AddTagsToResource			Tagging, Write
CreateGlobalCluster	neptune	rds:CreateGlobalCluster			Write
DeleteDBCluster	neptune	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBClusterSnapshot			Write
		rds:DeleteDBCluster			Write
		rds:DeleteDBInstance			Write
DeleteDBClusterEndpoint	neptune	rds:DeleteDBClusterEndpoint			Write
DeleteDBClusterParameterGroup	neptune	rds:DeleteDBClusterParameterGroup			Write
DeleteDBClusterSnapshot	neptune	rds:DeleteDBClusterSnapshot			Write
DeleteDBInstance	neptune	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBSnapshot			Write
		rds:DeleteDBInstance			Write
		rds:DeleteTenantDatabase			Write
DeleteDBParameterGroup	neptune	rds:DeleteDBParameterGroup			Write
DeleteDBSubnetGroup	neptune	rds:DeleteDBSubnetGroup			Write
DeleteEventSubscription	neptune	rds:DeleteEventSubscription			Write
DeleteGlobalCluster	neptune	rds:DeleteGlobalCluster			Write
DescribeDBClusterEndpoints	neptune	rds:DescribeDBClusterEndpoints			List
DescribeDBClusterParameterGroups	neptune	rds:DescribeDBClusterParameterGroups			List
DescribeDBClusterParameters	neptune	rds:DescribeDBClusterParameters			List
DescribeDBClusterSnapshotAttributes	neptune	rds:DescribeDBClusterSnapshotAttributes			List
DescribeDBClusterSnapshots	neptune	rds:DescribeDBClusterSnapshots			List
DescribeDBClusters	neptune	rds:DescribeDBClusters			List
DescribeDBEngineVersions	neptune	rds:DescribeDBEngineVersions			List
DescribeDBInstances	neptune	rds:DescribeDBInstances			List
DescribeDBParameterGroups	neptune	rds:DescribeDBParameterGroups			List
DescribeDBParameters	neptune	rds:DescribeDBParameters			List
DescribeDBSubnetGroups	neptune	rds:DescribeDBSubnetGroups			List
DescribeEngineDefaultClusterParameters	neptune	rds:DescribeEngineDefaultClusterParameters			List
DescribeEngineDefaultParameters	neptune	rds:DescribeEngineDefaultParameters			List
DescribeEventCategories	neptune	rds:DescribeEventCategories			List
DescribeEventSubscriptions	neptune	rds:DescribeEventSubscriptions			List
DescribeEvents	neptune	rds:DescribeEvents			List
DescribeGlobalClusters	neptune	rds:DescribeGlobalClusters			List
DescribeOrderableDBInstanceOptions	neptune	rds:DescribeOrderableDBInstanceOptions			List
DescribePendingMaintenanceActions	neptune	rds:DescribePendingMaintenanceActions			List
DescribeValidDBInstanceModifications	neptune	rds:DescribeValidDBInstanceModifications			List
FailoverDBCluster	neptune	rds:FailoverDBCluster			Write
FailoverGlobalCluster	neptune	rds:FailoverGlobalCluster			Write
ListTagsForResource	neptune	rds:ListTagsForResource			Read
ModifyDBCluster	neptune	rds:ModifyDBCluster			Write
		rds:ModifyDBInstance			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
ModifyDBClusterEndpoint	neptune	rds:ModifyDBClusterEndpoint			Write
ModifyDBClusterParameterGroup	neptune	rds:ModifyDBClusterParameterGroup			Write
ModifyDBClusterSnapshotAttribute	neptune	rds:ModifyDBClusterSnapshotAttribute			Write
ModifyDBInstance	neptune	rds:ModifyDBInstance			Write
ModifyDBInstance	neptune	iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
ModifyDBParameterGroup	neptune	rds:ModifyDBParameterGroup			Write
ModifyDBSubnetGroup	neptune	rds:ModifyDBSubnetGroup			Write
ModifyEventSubscription	neptune	rds:ModifyEventSubscription			Write
ModifyGlobalCluster	neptune	rds:ModifyGlobalCluster			Write
PromoteReadReplicaDBCluster	neptune	rds:PromoteReadReplicaDBCluster			Write
RebootDBInstance	neptune	rds:RebootDBInstance			Write
RemoveFromGlobalCluster	neptune	rds:RemoveFromGlobalCluster			Write
RemoveRoleFromDBCluster	neptune	rds:RemoveRoleFromDBCluster			Write
RemoveRoleFromDBCluster	neptune	iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
RemoveSourceIdentifierFromSubscription	neptune	rds:RemoveSourceIdentifierFromSubscription			Write
RemoveTagsFromResource	neptune	rds:RemoveTagsFromResource			Tagging, Write
ResetDBClusterParameterGroup	neptune	rds:ResetDBClusterParameterGroup			Write
ResetDBParameterGroup	neptune	rds:ResetDBParameterGroup			Write
RestoreDBClusterFromSnapshot	neptune	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBInstance			Write
		rds:RestoreDBClusterFromSnapshot			Write
		iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
RestoreDBClusterToPointInTime	neptune	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBInstance			Write
		rds:RestoreDBClusterToPointInTime			Write
		iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
StartDBCluster	neptune	rds:StartDBCluster			Write
StopDBCluster	neptune	rds:StopDBCluster			Write
SwitchoverGlobalCluster	neptune	rds:SwitchoverGlobalCluster			Write
AddRoleToDBCluster	rds	rds:AddRoleToDBCluster			Write
AddRoleToDBCluster	rds	iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
AddRoleToDBInstance	rds	rds:AddRoleToDBInstance			Write
AddRoleToDBInstance	rds	iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
AddSourceIdentifierToSubscription	rds	rds:AddSourceIdentifierToSubscription			Write
AddTagsToResource	rds	rds:AddTagsToResource			Tagging, Write
ApplyPendingMaintenanceAction	rds	rds:ApplyPendingMaintenanceAction			Write
AuthorizeDBSecurityGroupIngress	rds	rds:AuthorizeDBSecurityGroupIngress			Permissions management, Write
BacktrackDBCluster	rds	rds:BacktrackDBCluster			Write
CancelExportTask	rds	rds:CancelExportTask			Write
CopyDBClusterParameterGroup	rds	rds:AddTagsToResource			Tagging, Write
CopyDBClusterParameterGroup	rds	rds:CopyDBClusterParameterGroup			Write
CopyDBClusterSnapshot	rds	rds:AddTagsToResource			Tagging, Write
CopyDBClusterSnapshot	rds	rds:CopyDBClusterSnapshot			Write
CopyDBParameterGroup	rds	rds:AddTagsToResource			Tagging, Write
CopyDBParameterGroup	rds	rds:CopyDBParameterGroup			Write
CopyDBSnapshot	rds	rds:AddTagsToResource			Tagging, Write
		rds:CopyCustomDBEngineVersion			Write
		rds:CopyDBSnapshot			Write
CopyOptionGroup	rds	rds:AddTagsToResource			Tagging, Write
CopyOptionGroup	rds	rds:CopyOptionGroup			Write
CreateBlueGreenDeployment	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateBlueGreenDeployment			Write
		rds:CreateDBCluster			Write
		rds:CreateDBClusterEndpoint			Write
		rds:CreateDBInstance			Write
		rds:CreateDBInstanceReadReplica			Write
		rds:CreateGlobalCluster			Write
		iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
CreateCustomDBEngineVersion	rds	rds:AddTagsToResource			Tagging, Write
CreateCustomDBEngineVersion	rds	rds:CreateCustomDBEngineVersion			Write
CreateDBCluster	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBCluster			Write
		rds:CreateDBInstance			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
CreateDBClusterEndpoint	rds	rds:AddTagsToResource			Tagging, Write
CreateDBClusterEndpoint	rds	rds:CreateDBClusterEndpoint			Write
CreateDBClusterParameterGroup	rds	rds:AddTagsToResource			Tagging, Write
CreateDBClusterParameterGroup	rds	rds:CreateDBClusterParameterGroup			Write
CreateDBClusterSnapshot	rds	rds:AddTagsToResource			Tagging, Write
CreateDBClusterSnapshot	rds	rds:CreateDBClusterSnapshot			Write
CreateDBInstance	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBInstance			Write
		rds:CreateTenantDatabase			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
CreateDBInstanceReadReplica	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBInstanceReadReplica			Write
		rds:CreateTenantDatabase			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
CreateDBParameterGroup	rds	rds:AddTagsToResource			Tagging, Write
CreateDBParameterGroup	rds	rds:CreateDBParameterGroup			Write
CreateDBProxy	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBProxy			Write
		iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
CreateDBProxyEndpoint	rds	rds:AddTagsToResource			Tagging, Write
CreateDBProxyEndpoint	rds	rds:CreateDBProxyEndpoint			Write
CreateDBSecurityGroup	rds	rds:AddTagsToResource			Tagging, Write
CreateDBSecurityGroup	rds	rds:CreateDBSecurityGroup			Write
CreateDBShardGroup	rds	rds:AddTagsToResource			Tagging, Write
CreateDBShardGroup	rds	rds:CreateDBShardGroup			Write
CreateDBSnapshot	rds	rds:AddTagsToResource			Tagging, Write
CreateDBSnapshot	rds	rds:CreateDBSnapshot			Write
CreateDBSubnetGroup	rds	rds:AddTagsToResource			Tagging, Write
CreateDBSubnetGroup	rds	rds:CreateDBSubnetGroup			Write
CreateEventSubscription	rds	rds:AddTagsToResource			Tagging, Write
CreateEventSubscription	rds	rds:CreateEventSubscription			Write
CreateGlobalCluster	rds	rds:AddTagsToResource			Tagging, Write
CreateGlobalCluster	rds	rds:CreateGlobalCluster			Write
CreateIntegration	rds	rds:AddTagsToResource			Tagging, Write
CreateIntegration	rds	rds:CreateIntegration			Write
CreateOptionGroup	rds	rds:AddTagsToResource			Tagging, Write
CreateOptionGroup	rds	rds:CreateOptionGroup			Write
CreateTenantDatabase	rds	rds:AddTagsToResource			Tagging, Write
CreateTenantDatabase	rds	rds:CreateTenantDatabase			Write
DeleteBlueGreenDeployment	rds	rds:DeleteBlueGreenDeployment			Write
		rds:DeleteDBCluster			Write
		rds:DeleteDBClusterEndpoint			Write
		rds:DeleteDBInstance			Write
		rds:DeleteGlobalCluster			Write
		rds:PromoteReadReplica			Write
		rds:PromoteReadReplicaDBCluster			Write
		rds:RemoveFromGlobalCluster			Write
DeleteCustomDBEngineVersion	rds	rds:DeleteCustomDBEngineVersion			Write
DeleteDBCluster	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBClusterSnapshot			Write
		rds:DeleteDBCluster			Write
		rds:DeleteDBInstance			Write
DeleteDBClusterAutomatedBackup	rds	rds:DeleteDBClusterAutomatedBackup			Write
DeleteDBClusterEndpoint	rds	rds:DeleteDBClusterEndpoint			Write
DeleteDBClusterParameterGroup	rds	rds:DeleteDBClusterParameterGroup			Write
DeleteDBClusterSnapshot	rds	rds:DeleteDBClusterSnapshot			Write
DeleteDBInstance	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBSnapshot			Write
		rds:DeleteDBInstance			Write
		rds:DeleteTenantDatabase			Write
DeleteDBInstanceAutomatedBackup	rds	rds:DeleteDBInstanceAutomatedBackup			Write
DeleteDBParameterGroup	rds	rds:DeleteDBParameterGroup			Write
DeleteDBProxy	rds	rds:DeleteDBProxy			Write
DeleteDBProxyEndpoint	rds	rds:DeleteDBProxyEndpoint			Write
DeleteDBSecurityGroup	rds	rds:DeleteDBSecurityGroup			Write
DeleteDBShardGroup	rds	rds:DeleteDBShardGroup			Write
DeleteDBSnapshot	rds	rds:DeleteDBSnapshot			Write
DeleteDBSubnetGroup	rds	rds:DeleteDBSubnetGroup			Write
DeleteEventSubscription	rds	rds:DeleteEventSubscription			Write
DeleteGlobalCluster	rds	rds:DeleteGlobalCluster			Write
DeleteIntegration	rds	rds:DeleteIntegration			Write
DeleteOptionGroup	rds	rds:DeleteOptionGroup			Write
DeleteTenantDatabase	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBSnapshot			Write
		rds:DeleteTenantDatabase			Write
DeregisterDBProxyTargets	rds	rds:DeregisterDBProxyTargets			Write
DescribeAccountAttributes	rds	rds:DescribeAccountAttributes			List
DescribeBlueGreenDeployments	rds	rds:DescribeBlueGreenDeployments			List
DescribeCertificates	rds	rds:DescribeCertificates			List
DescribeDBClusterAutomatedBackups	rds	rds:DescribeDBClusterAutomatedBackups			List
DescribeDBClusterBacktracks	rds	rds:DescribeDBClusterBacktracks			List
DescribeDBClusterEndpoints	rds	rds:DescribeDBClusterEndpoints			List
DescribeDBClusterParameterGroups	rds	rds:DescribeDBClusterParameterGroups			List
DescribeDBClusterParameters	rds	rds:DescribeDBClusterParameters			List
DescribeDBClusterSnapshotAttributes	rds	rds:DescribeDBClusterSnapshotAttributes			List
DescribeDBClusterSnapshots	rds	rds:DescribeDBClusterSnapshots			List
DescribeDBClusters	rds	rds:DescribeDBClusters			List
DescribeDBEngineVersions	rds	rds:DescribeDBEngineVersions			List
DescribeDBInstanceAutomatedBackups	rds	rds:DescribeDBInstanceAutomatedBackups			List
DescribeDBInstances	rds	rds:DescribeDBInstances			List
DescribeDBLogFiles	rds	rds:DescribeDBLogFiles			List
DescribeDBMajorEngineVersions	rds	rds:DescribeDBMajorEngineVersions			List
DescribeDBParameterGroups	rds	rds:DescribeDBParameterGroups			List
DescribeDBParameters	rds	rds:DescribeDBParameters			List
DescribeDBProxies	rds	rds:DescribeDBProxies			List
DescribeDBProxyEndpoints	rds	rds:DescribeDBProxyEndpoints			List
DescribeDBProxyTargetGroups	rds	rds:DescribeDBProxyTargetGroups			List
DescribeDBProxyTargets	rds	rds:DescribeDBProxyTargets			List
DescribeDBRecommendations	rds	rds:DescribeDBRecommendations			List
DescribeDBSecurityGroups	rds	rds:DescribeDBSecurityGroups			List
DescribeDBShardGroups	rds	rds:DescribeDBShardGroups			List
DescribeDBSnapshotAttributes	rds	rds:DescribeDBSnapshotAttributes			List
DescribeDBSnapshotTenantDatabases	rds	rds:DescribeDBSnapshotTenantDatabases			List
DescribeDBSnapshots	rds	rds:DescribeDBSnapshots			List
DescribeDBSubnetGroups	rds	rds:DescribeDBSubnetGroups			List
DescribeEngineDefaultClusterParameters	rds	rds:DescribeEngineDefaultClusterParameters			List
DescribeEngineDefaultParameters	rds	rds:DescribeEngineDefaultParameters			List
DescribeEventCategories	rds	rds:DescribeEventCategories			List
DescribeEventSubscriptions	rds	rds:DescribeEventSubscriptions			List
DescribeEvents	rds	rds:DescribeEvents			List
DescribeExportTasks	rds	rds:DescribeExportTasks			List
DescribeGlobalClusters	rds	rds:DescribeGlobalClusters			List
DescribeIntegrations	rds	rds:DescribeIntegrations			List
DescribeOptionGroupOptions	rds	rds:DescribeOptionGroupOptions			List
DescribeOptionGroups	rds	rds:DescribeOptionGroups			List
DescribeOrderableDBInstanceOptions	rds	rds:DescribeOrderableDBInstanceOptions			List
DescribePendingMaintenanceActions	rds	rds:DescribePendingMaintenanceActions			List
DescribeReservedDBInstances	rds	rds:DescribeReservedDBInstances			List
DescribeReservedDBInstancesOfferings	rds	rds:DescribeReservedDBInstancesOfferings			List
DescribeSourceRegions	rds	rds:DescribeSourceRegions			List
DescribeTenantDatabases	rds	rds:DescribeTenantDatabases			List
DescribeValidDBInstanceModifications	rds	rds:DescribeValidDBInstanceModifications			List
DisableHttpEndpoint	rds	rds:DisableHttpEndpoint			Write
DownloadDBLogFilePortion	rds	rds:DownloadDBLogFilePortion			Read
EnableHttpEndpoint	rds	rds:EnableHttpEndpoint			Write
FailoverDBCluster	rds	rds:FailoverDBCluster			Write
FailoverGlobalCluster	rds	rds:FailoverGlobalCluster			Write
ListTagsForResource	rds	rds:ListTagsForResource			Read
ModifyActivityStream	rds	rds:ModifyActivityStream			Write
ModifyCertificates	rds	rds:ModifyCertificates			Write
ModifyCurrentDBClusterCapacity	rds	rds:ModifyCurrentDBClusterCapacity			Write
ModifyCustomDBEngineVersion	rds	rds:ModifyCustomDBEngineVersion			Write
ModifyDBCluster	rds	rds:ModifyDBCluster			Write
		rds:ModifyDBInstance			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
ModifyDBClusterEndpoint	rds	rds:ModifyDBClusterEndpoint			Write
ModifyDBClusterParameterGroup	rds	rds:ModifyDBClusterParameterGroup			Write
ModifyDBClusterSnapshotAttribute	rds	rds:ModifyDBClusterSnapshotAttribute			Write
ModifyDBInstance	rds	rds:ModifyDBInstance			Write
ModifyDBInstance	rds	iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
ModifyDBParameterGroup	rds	rds:ModifyDBParameterGroup			Write
ModifyDBProxy	rds	rds:ModifyDBProxy			Write
ModifyDBProxy	rds	iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
ModifyDBProxyEndpoint	rds	rds:ModifyDBProxyEndpoint			Write
ModifyDBProxyTargetGroup	rds	rds:ModifyDBProxyTargetGroup			Write
ModifyDBRecommendation	rds	rds:ModifyDBRecommendation			Write
ModifyDBShardGroup	rds	rds:ModifyDBShardGroup			Write
ModifyDBSnapshot	rds	rds:ModifyDBSnapshot			Write
ModifyDBSnapshotAttribute	rds	rds:ModifyDBSnapshotAttribute			Write
ModifyDBSubnetGroup	rds	rds:ModifyDBSubnetGroup			Write
ModifyEventSubscription	rds	rds:ModifyEventSubscription			Write
ModifyGlobalCluster	rds	rds:ModifyGlobalCluster			Write
ModifyIntegration	rds	rds:ModifyIntegration			Write
ModifyOptionGroup	rds	rds:ModifyOptionGroup			Write
ModifyOptionGroup	rds	iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
ModifyTenantDatabase	rds	rds:ModifyTenantDatabase			Write
PromoteReadReplica	rds	rds:AddTagsToResource			Tagging, Write
PromoteReadReplica	rds	rds:PromoteReadReplica			Write
PromoteReadReplicaDBCluster	rds	rds:PromoteReadReplicaDBCluster			Write
PurchaseReservedDBInstancesOffering	rds	rds:AddTagsToResource			Tagging, Write
PurchaseReservedDBInstancesOffering	rds	rds:PurchaseReservedDBInstancesOffering			Write
RebootDBCluster	rds	rds:RebootDBCluster			Write
RebootDBCluster	rds	rds:RebootDBInstance			Write
RebootDBInstance	rds	rds:RebootDBInstance			Write
RebootDBShardGroup	rds	rds:RebootDBShardGroup			Write
RegisterDBProxyTargets	rds	rds:RegisterDBProxyTargets			Write
RemoveFromGlobalCluster	rds	rds:RemoveFromGlobalCluster			Write
RemoveRoleFromDBCluster	rds	rds:RemoveRoleFromDBCluster			Write
RemoveRoleFromDBCluster	rds	iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
RemoveRoleFromDBInstance	rds	rds:RemoveRoleFromDBInstance			Write
RemoveRoleFromDBInstance	rds	iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
RemoveSourceIdentifierFromSubscription	rds	rds:RemoveSourceIdentifierFromSubscription			Write
RemoveTagsFromResource	rds	rds:RemoveTagsFromResource			Tagging, Write
ResetDBClusterParameterGroup	rds	rds:ResetDBClusterParameterGroup			Write
ResetDBParameterGroup	rds	rds:ResetDBParameterGroup			Write
RestoreDBClusterFromS3	rds	rds:AddTagsToResource			Tagging, Write
		rds:RestoreDBClusterFromS3			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
RestoreDBClusterFromSnapshot	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBInstance			Write
		rds:RestoreDBClusterFromSnapshot			Write
		iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
RestoreDBClusterToPointInTime	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBInstance			Write
		rds:RestoreDBClusterToPointInTime			Write
		iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
RestoreDBInstanceFromDBSnapshot	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateTenantDatabase			Write
		rds:RestoreDBInstanceFromDBSnapshot			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
RestoreDBInstanceFromS3	rds	rds:AddTagsToResource			Tagging, Write
		rds:RestoreDBInstanceFromS3			Write
		iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
RestoreDBInstanceToPointInTime	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateTenantDatabase			Write
		rds:RestoreDBInstanceToPointInTime			Write
		iam:PassRole	iam:PassedToService	rds-preview.amazonaws.com, rds.amazonaws.com	Write
RevokeDBSecurityGroupIngress	rds	rds:RevokeDBSecurityGroupIngress			Write
StartActivityStream	rds	rds:StartActivityStream			Write
StartDBCluster	rds	rds:StartDBCluster			Write
StartDBInstance	rds	rds:StartDBInstance			Write
StartDBInstanceAutomatedBackupsReplication	rds	rds:AddTagsToResource			Tagging, Write
StartDBInstanceAutomatedBackupsReplication	rds	rds:StartDBInstanceAutomatedBackupsReplication			Write
StartExportTask	rds	rds:StartExportTask			Write
StartExportTask	rds	iam:PassRole	iam:PassedToService	rds.amazonaws.com	Write
StopActivityStream	rds	rds:StopActivityStream			Write
StopDBCluster	rds	rds:StopDBCluster			Write
StopDBInstance	rds	rds:AddTagsToResource			Tagging, Write
		rds:CreateDBSnapshot			Write
		rds:StopDBInstance			Write
StopDBInstanceAutomatedBackupsReplication	rds	rds:StopDBInstanceAutomatedBackupsReplication			Write
SwitchoverBlueGreenDeployment	rds	rds:ModifyDBCluster			Write
		rds:ModifyDBInstance			Write
		rds:ModifyGlobalCluster			Write
		rds:PromoteReadReplica			Write
		rds:PromoteReadReplicaDBCluster			Write
		rds:SwitchoverBlueGreenDeployment			Write
SwitchoverGlobalCluster	rds	rds:SwitchoverGlobalCluster			Write
SwitchoverReadReplica	rds	rds:SwitchoverReadReplica			Write

Actions defined by Amazon RDS

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddRoleToDBCluster	Grants permission to associate an Identity and Access Management (IAM) role from an Aurora DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
AddRoleToDBInstance	Grants permission to associate an Amazon Identity and Access Management (IAM) role with a DB instance	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
AddSourceIdentifierToSubscription	Grants permission to add a source identifier to an existing RDS event notification subscription	es*	aws:ResourceTag/${TagKey} rds:es-tag/${TagKey}	Write
AddTagsToResource	Grants permission to add metadata tags to an Amazon RDS resource	auto-backup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest	Tagging, Write
		cev	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest
		cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-tag/${TagKey} rds:req-tag/${TagKey} rds:TagsFromRequest
		cluster-auto-backup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest
		cluster-endpoint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest
		cluster-pg	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:req-tag/${TagKey} rds:TagsFromRequest
		cluster-snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-snapshot-tag/${TagKey} rds:req-tag/${TagKey} rds:TagsFromRequest
		db	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:TagsFromRequest rds:Vpc
		deployment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest
		es	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:es-tag/${TagKey} rds:req-tag/${TagKey} rds:TagsFromRequest
		global-cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest
		integration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest
		og	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:og-tag/${TagKey} rds:req-tag/${TagKey} rds:TagsFromRequest
		pg	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:pg-tag/${TagKey} rds:req-tag/${TagKey} rds:TagsFromRequest
		proxy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest
		proxy-endpoint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest
		ri	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:ri-tag/${TagKey} rds:TagsFromRequest
		secgrp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:secgrp-tag/${TagKey} rds:TagsFromRequest
		shardgrp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:snapshot-tag/${TagKey} rds:TagsFromRequest
		snapshot-tenant-database	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest
		subgrp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:subgrp-tag/${TagKey} rds:TagsFromRequest
		target-group	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest
		tenant-database	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:TagsFromRequest
ApplyPendingMaintenanceAction	Grants permission to apply a pending maintenance action to a resource	cluster	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
ApplyPendingMaintenanceAction		db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
AuthorizeDBSecurityGroupIngress	Grants permission to enable ingress to a DBSecurityGroup using one of two forms of authorization	secgrp*	aws:ResourceTag/${TagKey} rds:secgrp-tag/${TagKey}	Permissions management, Write
BacktrackDBCluster	Grants permission to backtrack a DB cluster to a specific time, without creating a new DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
CancelExportTask	Grants permission to cancel an export task in progress			Write
CopyDBClusterParameterGroup	Grants permission to copy the specified DB cluster parameter group	cluster-pg*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:req-tag/${TagKey}	Write
CopyDBClusterSnapshot	Grants permission to create a snapshot of a DB cluster	cluster-snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-snapshot-tag/${TagKey} rds:req-tag/${TagKey}	Write
CopyDBParameterGroup	Grants permission to copy the specified DB parameter group	pg*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:pg-tag/${TagKey} rds:req-tag/${TagKey}	Write
CopyDBSnapshot	Grants permission to copy the specified DB snapshot	snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:CopyOptionGroup rds:req-tag/${TagKey} rds:snapshot-tag/${TagKey}	Write
CopyOptionGroup	Grants permission to copy the specified option group	og*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:og-tag/${TagKey} rds:req-tag/${TagKey}	Write
CreateBlueGreenDeployment	Grants permission to create a blue-green deployment for a given source cluster or instance	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:cluster-tag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:pg-tag/${TagKey} rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
		cluster-pg	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:cluster-tag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:pg-tag/${TagKey} rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc
		db	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:cluster-tag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:pg-tag/${TagKey} rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc
		deployment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:cluster-tag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:pg-tag/${TagKey} rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc
		pg	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:cluster-tag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:pg-tag/${TagKey} rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc
CreateCustomDBEngineVersion	Grants permission to create a custom engine version	cev*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}	Write
CreateDBCluster	Grants permission to create a new DB cluster	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-tag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:ManageMasterUserPassword rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize	Write
		cluster-pg*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:ManageMasterUserPassword rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize
		db	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:ManageMasterUserPassword rds:MultiAz rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc
		global-cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:ManageMasterUserPassword rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize
		og*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:ManageMasterUserPassword rds:og-tag/${TagKey} rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize
		subgrp*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:ManageMasterUserPassword rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:subgrp-tag/${TagKey}
CreateDBClusterEndpoint	Grants permission to create a new custom endpoint and associates it with an Amazon Aurora DB cluster or Amazon DocumentDB cluster	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-tag/${TagKey} rds:EndpointType rds:req-tag/${TagKey}	Write
CreateDBClusterEndpoint		cluster-endpoint*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:EndpointType rds:req-tag/${TagKey}	Write
CreateDBClusterParameterGroup	Grants permission to create a new DB cluster parameter group	cluster-pg*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:req-tag/${TagKey}	Write
CreateDBClusterSnapshot	Grants permission to create a snapshot of a DB cluster	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-tag/${TagKey} rds:req-tag/${TagKey}	Write
CreateDBClusterSnapshot	Grants permission to create a snapshot of a DB cluster	cluster-snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-snapshot-tag/${TagKey} rds:req-tag/${TagKey}	Write
CreateDBInstance	Grants permission to create a new DB instance	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:cluster-tag/${TagKey} rds:ManageMasterUserPassword rds:PubliclyAccessible rds:req-tag/${TagKey}	Write
		db*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:ManageMasterUserPassword rds:MultiAz rds:Piops rds:PubliclyAccessible rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc
		og	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:ManageMasterUserPassword rds:og-tag/${TagKey} rds:PubliclyAccessible rds:req-tag/${TagKey}
		pg	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:ManageMasterUserPassword rds:pg-tag/${TagKey} rds:PubliclyAccessible rds:req-tag/${TagKey}
		secgrp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:ManageMasterUserPassword rds:PubliclyAccessible rds:req-tag/${TagKey} rds:secgrp-tag/${TagKey}
		subgrp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:ManageMasterUserPassword rds:PubliclyAccessible rds:req-tag/${TagKey} rds:subgrp-tag/${TagKey}
CreateDBInstanceReadReplica	Grants permission to create a DB instance that acts as a Read Replica of a source DB instance	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-tag/${TagKey} rds:PubliclyAccessible rds:req-tag/${TagKey}	Write
		db*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:PubliclyAccessible rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc
		og*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:og-tag/${TagKey} rds:PubliclyAccessible rds:req-tag/${TagKey}
		pg*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:pg-tag/${TagKey} rds:PubliclyAccessible rds:req-tag/${TagKey}
		subgrp*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:PubliclyAccessible rds:req-tag/${TagKey} rds:subgrp-tag/${TagKey}
CreateDBParameterGroup	Grants permission to create a new DB parameter group	pg*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:pg-tag/${TagKey} rds:req-tag/${TagKey}	Write
CreateDBProxy	Grants permission to create a database proxy		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDBProxyEndpoint	Grants permission to create a database proxy endpoint	proxy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDBProxyEndpoint	Grants permission to create a database proxy endpoint	proxy-endpoint*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDBSecurityGroup	Grants permission to create a new DB security group. DB security groups control access to a DB instance	secgrp*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:secgrp-tag/${TagKey}	Write
CreateDBShardGroup	Grants permission to create a new Aurora Limitless Database DB shard group	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-tag/${TagKey} rds:PubliclyAccessible rds:req-tag/${TagKey}	Write
CreateDBShardGroup		shardgrp*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:PubliclyAccessible rds:req-tag/${TagKey}	Write
CreateDBSnapshot	Grants permission to create a DBSnapshot	db*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
CreateDBSnapshot	Grants permission to create a DBSnapshot	snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:req-tag/${TagKey} rds:snapshot-tag/${TagKey}	Write
CreateDBSubnetGroup	Grants permission to create a new DB subnet group	subgrp*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:subgrp-tag/${TagKey}	Write
CreateEventSubscription	Grants permission to create an RDS event notification subscription	es*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:es-tag/${TagKey} rds:req-tag/${TagKey}	Write
CreateGlobalCluster	Grants permission to create an Aurora global database or DocumentDB global database spread across multiple regions	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-tag/${TagKey} rds:req-tag/${TagKey}	Write
CreateGlobalCluster		global-cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}	Write
CreateIntegration	Grants permission to create an Aurora zero-ETL integration with Redshift	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-tag/${TagKey} rds:req-tag/${TagKey}	Write
		db	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc
		integration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
CreateOptionGroup	Grants permission to create a new option group	og*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:og-tag/${TagKey} rds:req-tag/${TagKey}	Write
CreateTenantDatabase	Grants permission to create a new tenant database	db*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:ManageMasterUserPassword rds:MultiAz rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:TenantDatabaseName rds:Vpc	Write
CreateTenantDatabase	Grants permission to create a new tenant database	tenant-database*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:ManageMasterUserPassword rds:req-tag/${TagKey} rds:TenantDatabaseName	Write
DeleteBlueGreenDeployment	Grants permission to delete blue green deployments	deployment*	aws:ResourceTag/${TagKey}	Write
DeleteCustomDBEngineVersion	Grants permission to delete an existing custom engine version	cev*	aws:ResourceTag/${TagKey}	Write
DeleteDBCluster	Grants permission to delete a previously provisioned DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
DeleteDBCluster		cluster-snapshot*	aws:ResourceTag/${TagKey} rds:cluster-snapshot-tag/${TagKey}	Write
DeleteDBClusterAutomatedBackup	Grants permission to delete cluster automated backups based on the source cluster's DbClusterResourceId value or the restorable cluster's resource ID	cluster-auto-backup*	aws:ResourceTag/${TagKey}	Write
DeleteDBClusterEndpoint	Grants permission to delete a custom endpoint and removes it from an Amazon Aurora DB cluster or Amazon DocumentDB cluster	cluster-endpoint*	aws:ResourceTag/${TagKey}	Write
DeleteDBClusterParameterGroup	Grants permission to delete a specified DB cluster parameter group	cluster-pg*	aws:ResourceTag/${TagKey} rds:cluster-pg-tag/${TagKey}	Write
DeleteDBClusterSnapshot	Grants permission to delete a DB cluster snapshot	cluster-snapshot*	aws:ResourceTag/${TagKey} rds:cluster-snapshot-tag/${TagKey}	Write
DeleteDBInstance	Grants permission to delete a previously provisioned DB instance	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
DeleteDBInstanceAutomatedBackup	Grants permission to delete automated backups based on the source instance's DbiResourceId value or the restorable instance's resource ID	auto-backup*	aws:ResourceTag/${TagKey}	Write
DeleteDBParameterGroup	Grants permission to delete a specified DBParameterGroup	pg*	aws:ResourceTag/${TagKey} rds:pg-tag/${TagKey}	Write
DeleteDBProxy	Grants permission to delete a database proxy	proxy*	aws:ResourceTag/${TagKey}	Write
DeleteDBProxyEndpoint	Grants permission to delete a database proxy endpoint	proxy-endpoint*	aws:ResourceTag/${TagKey}	Write
DeleteDBSecurityGroup	Grants permission to delete a DB security group	secgrp*	aws:ResourceTag/${TagKey} rds:secgrp-tag/${TagKey}	Write
DeleteDBShardGroup	Grants permission to delete an Aurora Limitless Database DB shard group	shardgrp*	aws:ResourceTag/${TagKey}	Write
DeleteDBSnapshot	Grants permission to delete a DBSnapshot	snapshot*	aws:ResourceTag/${TagKey} rds:snapshot-tag/${TagKey}	Write
DeleteDBSubnetGroup	Grants permission to delete a DB subnet group	subgrp*	aws:ResourceTag/${TagKey} rds:subgrp-tag/${TagKey}	Write
DeleteEventSubscription	Grants permission to delete an RDS event notification subscription	es*	aws:ResourceTag/${TagKey} rds:es-tag/${TagKey}	Write
DeleteGlobalCluster	Grants permission to delete a global database cluster	global-cluster*	aws:ResourceTag/${TagKey}	Write
DeleteIntegration	Grants permission to delete an Aurora zero-ETL integration with Redshift	integration*	aws:ResourceTag/${TagKey}	Write
DeleteOptionGroup	Grants permission to delete an existing option group	og*	aws:ResourceTag/${TagKey} rds:og-tag/${TagKey}	Write
DeleteTenantDatabase	Grants permission to delete a tenant database	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
DeleteTenantDatabase	Grants permission to delete a tenant database	tenant-database*	aws:ResourceTag/${TagKey}	Write
DeregisterDBProxyTargets	Grants permission to remove targets from a database proxy target group	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
		db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc
		proxy*	aws:ResourceTag/${TagKey}
		target-group*	aws:ResourceTag/${TagKey}
DescribeAccountAttributes	Grants permission to list all of the attributes for a customer account			List
DescribeBlueGreenDeployments	Grants permission to describe blue green deployments	deployment	aws:ResourceTag/${TagKey}	List
DescribeCertificates	Grants permission to list the set of CA certificates provided by Amazon RDS for this Amazon Web Services account			List
DescribeDBClusterAutomatedBackups	Grants permission to return a list of cluster automated backups for both current and deleted clusters	cluster	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	List
DescribeDBClusterAutomatedBackups		cluster-auto-backup	aws:ResourceTag/${TagKey}	List
DescribeDBClusterBacktracks	Grants permission to return information about backtracks for a DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	List
DescribeDBClusterEndpoints	Grants permission to return information about endpoints for an Amazon Aurora DB cluster	cluster	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	List
DescribeDBClusterEndpoints		cluster-endpoint	aws:ResourceTag/${TagKey}	List
DescribeDBClusterParameterGroups	Grants permission to return a list of DBClusterParameterGroup descriptions	cluster-pg	aws:ResourceTag/${TagKey} rds:cluster-pg-tag/${TagKey}	List
DescribeDBClusterParameters	Grants permission to return the detailed parameter list for a particular DB cluster parameter group	cluster-pg*	aws:ResourceTag/${TagKey} rds:cluster-pg-tag/${TagKey}	List
DescribeDBClusterSnapshotAttributes	Grants permission to return a list of DB cluster snapshot attribute names and values for a manual DB cluster snapshot	cluster-snapshot*	aws:ResourceTag/${TagKey} rds:cluster-snapshot-tag/${TagKey}	List
DescribeDBClusterSnapshots	Grants permission to return information about DB cluster snapshots	cluster	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	List
DescribeDBClusterSnapshots		cluster-snapshot	aws:ResourceTag/${TagKey} rds:cluster-snapshot-tag/${TagKey}	List
DescribeDBClusters	Grants permission to return information about provisioned Aurora DB clusters or DocumentDB clusters	cluster	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	List
DescribeDBEngineVersions	Grants permission to return a list of the available DB engines			List
DescribeDBInstanceAutomatedBackups	Grants permission to return a list of automated backups for both current and deleted instances	auto-backup	aws:ResourceTag/${TagKey}	List
DescribeDBInstanceAutomatedBackups		db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	List
DescribeDBInstances	Grants permission to return information about provisioned RDS instances	db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	List
DescribeDBLogFiles	Grants permission to return a list of DB log files for the DB instance	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	List
DescribeDBMajorEngineVersions	Grants permission to return information specific for each DB major engine versions			List
DescribeDBParameterGroups	Grants permission to return a list of DBParameterGroup descriptions	pg	aws:ResourceTag/${TagKey} rds:pg-tag/${TagKey}	List
DescribeDBParameters	Grants permission to return the detailed parameter list for a particular DB parameter group	pg*	aws:ResourceTag/${TagKey} rds:pg-tag/${TagKey}	List
DescribeDBProxies	Grants permission to view proxies	proxy	aws:ResourceTag/${TagKey}	List
DescribeDBProxyEndpoints	Grants permission to view proxy endpoints	proxy	aws:ResourceTag/${TagKey}	List
DescribeDBProxyEndpoints	Grants permission to view proxy endpoints	proxy-endpoint	aws:ResourceTag/${TagKey}	List
DescribeDBProxyTargetGroups	Grants permission to view database proxy target group details	proxy*	aws:ResourceTag/${TagKey}	List
DescribeDBProxyTargets	Grants permission to view database proxy target details	proxy*	aws:ResourceTag/${TagKey}	List
DescribeDBProxyTargets	Grants permission to view database proxy target details	target-group*	aws:ResourceTag/${TagKey}	List
DescribeDBRecommendations	Grants permission to list recommendation details			List
DescribeDBSecurityGroups	Grants permission to return a list of DBSecurityGroup descriptions	secgrp	aws:ResourceTag/${TagKey} rds:secgrp-tag/${TagKey}	List
DescribeDBShardGroups	Grants permission to return information about all Aurora Limitless Database DB shard groups for this account. You can filter by shard group(s)	shardgrp	aws:ResourceTag/${TagKey}	List
DescribeDBSnapshotAttributes	Grants permission to return a list of DB snapshot attribute names and values for a manual DB snapshot	snapshot*	aws:ResourceTag/${TagKey} rds:snapshot-tag/${TagKey}	List
DescribeDBSnapshotTenantDatabases	Grants permission to return information about tenant databases in DB snapshots. You can filter by Region or snapshot	db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	List
		snapshot	aws:ResourceTag/${TagKey} rds:snapshot-tag/${TagKey}
		snapshot-tenant-database	aws:ResourceTag/${TagKey}
DescribeDBSnapshots	Grants permission to return information about DB snapshots	db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	List
DescribeDBSnapshots	Grants permission to return information about DB snapshots	snapshot	aws:ResourceTag/${TagKey} rds:snapshot-tag/${TagKey}	List
DescribeDBSubnetGroups	Grants permission to return a list of DBSubnetGroup descriptions	subgrp	aws:ResourceTag/${TagKey} rds:subgrp-tag/${TagKey}	List
DescribeEngineDefaultClusterParameters	Grants permission to return the default engine and system parameter information for the cluster database engine			List
DescribeEngineDefaultParameters	Grants permission to return the default engine and system parameter information for the specified database engine			List
DescribeEventCategories	Grants permission to display a list of categories for all event source types, or, if specified, for a specified source type			List
DescribeEventSubscriptions	Grants permission to list all the subscription descriptions for a customer account	es	aws:ResourceTag/${TagKey} rds:es-tag/${TagKey}	List
DescribeEvents	Grants permission to return events related to DB instances, DB security groups, DB snapshots, and DB parameter groups for the past 14 days			List
DescribeExportTasks	Grants permission to return information about the export tasks	cluster	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	List
		cluster-snapshot	aws:ResourceTag/${TagKey} rds:cluster-snapshot-tag/${TagKey}
		snapshot	aws:ResourceTag/${TagKey} rds:snapshot-tag/${TagKey}
DescribeGlobalClusters	Grants permission to return information about Aurora global database clusters or DocumentDB global database clusters	global-cluster	aws:ResourceTag/${TagKey}	List
DescribeIntegrations	Grants permission to describe an Aurora zero-ETL integration with Redshift	integration	aws:ResourceTag/${TagKey}	List
DescribeOptionGroupOptions	Grants permission to describe all available options			List
DescribeOptionGroups	Grants permission to describe the available option groups	og	aws:ResourceTag/${TagKey} rds:og-tag/${TagKey}	List
DescribeOrderableDBInstanceOptions	Grants permission to return a list of orderable DB instance options for the specified engine			List
DescribePendingMaintenanceActions	Grants permission to return a list of resources (for example, DB instances) that have at least one pending maintenance action	cluster	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	List
DescribePendingMaintenanceActions		db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	List
DescribeReservedDBInstances	Grants permission to return information about reserved DB instances for this account, or about a specified reserved DB instance	ri	aws:ResourceTag/${TagKey} rds:ri-tag/${TagKey}	List
DescribeReservedDBInstancesOfferings	Grants permission to list available reserved DB instance offerings			List
DescribeSourceRegions	Grants permission to return a list of the source Amazon Web Services Regions where the current Amazon Web Services Region can create a Read Replica or copy a DB snapshot from			List
DescribeTenantDatabases	Grants permission to return information about provisioned tenant databases. You can filter by Region or snapshot	db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	List
DescribeTenantDatabases		tenant-database	aws:ResourceTag/${TagKey}	List
DescribeValidDBInstanceModifications	Grants permission to list available modifications you can make to your DB instance	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	List
DisableHttpEndpoint	Grants permission to disable http endpoint for a DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
DownloadCompleteDBLogFile	Grants permission to download specified log file	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Read
DownloadDBLogFilePortion	Grants permission to download all or a portion of the specified log file, up to 1 MB in size	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Read
EnableHttpEndpoint	Grants permission to enable http endpoint for a DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
FailoverDBCluster	Grants permission to force a failover for a DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
FailoverDBCluster	Grants permission to force a failover for a DB cluster	db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
FailoverGlobalCluster	Grants permission to failover a global cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
FailoverGlobalCluster	Grants permission to failover a global cluster	global-cluster*	aws:ResourceTag/${TagKey}	Write
ListTagsForResource	Grants permission to list all tags on an Amazon RDS resource	auto-backup	aws:ResourceTag/${TagKey}	Read
		cev	aws:ResourceTag/${TagKey}
		cluster	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}
		cluster-auto-backup	aws:ResourceTag/${TagKey}
		cluster-endpoint	aws:ResourceTag/${TagKey}
		cluster-pg	aws:ResourceTag/${TagKey} rds:cluster-pg-tag/${TagKey}
		cluster-snapshot	aws:ResourceTag/${TagKey} rds:cluster-snapshot-tag/${TagKey}
		db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc
		es	aws:ResourceTag/${TagKey} rds:es-tag/${TagKey}
		global-cluster	aws:ResourceTag/${TagKey}
		integration	aws:ResourceTag/${TagKey}
		og	aws:ResourceTag/${TagKey} rds:og-tag/${TagKey}
		pg	aws:ResourceTag/${TagKey} rds:pg-tag/${TagKey}
		proxy	aws:ResourceTag/${TagKey}
		proxy-endpoint	aws:ResourceTag/${TagKey}
		ri	aws:ResourceTag/${TagKey} rds:ri-tag/${TagKey}
		secgrp	aws:ResourceTag/${TagKey} rds:secgrp-tag/${TagKey}
		shardgrp	aws:ResourceTag/${TagKey}
		snapshot	aws:ResourceTag/${TagKey} rds:snapshot-tag/${TagKey}
		snapshot-tenant-database	aws:ResourceTag/${TagKey}
		subgrp	aws:ResourceTag/${TagKey} rds:subgrp-tag/${TagKey}
		target-group	aws:ResourceTag/${TagKey}
		tenant-database	aws:ResourceTag/${TagKey}
ModifyActivityStream	Grants permission to modify a database activity stream	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
ModifyCertificates	Grants permission to modify the system-default Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate for Amazon RDS for new DB instances			Write
ModifyCurrentDBClusterCapacity	Grants permission to modify current cluster capacity for an Amazon Aurora Serverless DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
ModifyCustomDBEngineVersion	Grants permission to modify an existing custom engine version	cev*	aws:ResourceTag/${TagKey}	Write
ModifyDBCluster	Grants permission to modify a setting for an Amazon Aurora DB cluster or Amazon DocumentDB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey} rds:DatabaseClass rds:ManageMasterUserPassword rds:Piops rds:StorageSize	Write
		cluster-pg	aws:ResourceTag/${TagKey} rds:cluster-pg-tag/${TagKey} rds:DatabaseClass rds:ManageMasterUserPassword rds:Piops rds:StorageSize
		og	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:ManageMasterUserPassword rds:og-tag/${TagKey} rds:Piops rds:StorageSize
		pg	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:ManageMasterUserPassword rds:pg-tag/${TagKey} rds:Piops rds:StorageSize
ModifyDBClusterEndpoint	Grants permission to modify the properties of an endpoint in an Amazon Aurora DB cluster or Amazon DocumentDB cluster	cluster-endpoint*	aws:ResourceTag/${TagKey}	Write
ModifyDBClusterParameterGroup	Grants permission to modify the parameters of a DB cluster parameter group	cluster-pg*	aws:ResourceTag/${TagKey} rds:cluster-pg-tag/${TagKey}	Write
ModifyDBClusterSnapshotAttribute	Grants permission to add an attribute and values to, or removes an attribute and values from, a manual DB cluster snapshot	cluster-snapshot*	aws:ResourceTag/${TagKey} rds:cluster-snapshot-tag/${TagKey}	Write
ModifyDBInstance	Grants permission to modify settings for a DB instance	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:ManageMasterUserPassword rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
		og	aws:ResourceTag/${TagKey} rds:ManageMasterUserPassword rds:og-tag/${TagKey}
		pg	aws:ResourceTag/${TagKey} rds:ManageMasterUserPassword rds:pg-tag/${TagKey}
		secgrp	aws:ResourceTag/${TagKey} rds:ManageMasterUserPassword rds:secgrp-tag/${TagKey}
		subgrp	aws:ResourceTag/${TagKey} rds:ManageMasterUserPassword rds:subgrp-tag/${TagKey}
ModifyDBParameterGroup	Grants permission to modify the parameters of a DB parameter group	pg*	aws:ResourceTag/${TagKey} rds:pg-tag/${TagKey}	Write
ModifyDBProxy	Grants permission to modify database proxy	proxy*	aws:ResourceTag/${TagKey}	Write
ModifyDBProxyEndpoint	Grants permission to modify database proxy endpoint	proxy-endpoint*	aws:ResourceTag/${TagKey}	Write
ModifyDBProxyTargetGroup	Grants permission to modify target group for a database proxy	target-group*	aws:ResourceTag/${TagKey}	Write
ModifyDBRecommendation	Grants permission to modify recommendation			Write
ModifyDBShardGroup	Grants permission to modify properties of an Aurora Limitless Database DB shard group	shardgrp*	aws:ResourceTag/${TagKey}	Write
ModifyDBSnapshot	Grants permission to update a manual DB snapshot, which can be encrypted or not encrypted, with a new engine version	og	aws:ResourceTag/${TagKey} rds:og-tag/${TagKey}	Write
ModifyDBSnapshot		snapshot*	aws:ResourceTag/${TagKey} rds:snapshot-tag/${TagKey}	Write
ModifyDBSnapshotAttribute	Grants permission to add an attribute and values to, or removes an attribute and values from, a manual DB snapshot	snapshot*	aws:ResourceTag/${TagKey} rds:snapshot-tag/${TagKey}	Write
ModifyDBSubnetGroup	Grants permission to modify an existing DB subnet group	subgrp*	aws:ResourceTag/${TagKey} rds:subgrp-tag/${TagKey}	Write
ModifyEventSubscription	Grants permission to modify an existing RDS event notification subscription	es*	aws:ResourceTag/${TagKey} rds:es-tag/${TagKey}	Write
ModifyGlobalCluster	Grants permission to modify a setting for an Amazon Aurora global cluster or Amazon DocumentDB global cluster	global-cluster*	aws:ResourceTag/${TagKey}	Write
ModifyIntegration	Grants permission to modify an Aurora zero-ETL integration with Redshift	integration*	aws:ResourceTag/${TagKey}	Write
ModifyOptionGroup	Grants permission to modify an existing option group	og*	aws:ResourceTag/${TagKey} rds:og-tag/${TagKey}	Write
ModifyTenantDatabase	Grants permission to modify a tenant database	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:ManageMasterUserPassword rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:TenantDatabaseName rds:Vpc	Write
ModifyTenantDatabase	Grants permission to modify a tenant database	tenant-database*	aws:ResourceTag/${TagKey} rds:ManageMasterUserPassword rds:TenantDatabaseName	Write
PromoteReadReplica	Grants permission to promote a Read Replica DB instance to a standalone DB instance	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
PromoteReadReplicaDBCluster	Grants permission to promote a Read Replica DB cluster to a standalone DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
PurchaseReservedDBInstancesOffering	Grants permission to purchase a reserved DB instance offering	ri*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:ri-tag/${TagKey}	Write
RebootDBCluster	Grants permission to reboot a previously provisioned DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
RebootDBInstance	Grants permission to restart the database engine service	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
RebootDBShardGroup	Grants permission to reboot an Aurora Limitless Database DB shard group	shardgrp*	aws:ResourceTag/${TagKey}	Write
RegisterDBProxyTargets	Grants permission to add targets to a database proxy target group	db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
RegisterDBProxyTargets		target-group*	aws:ResourceTag/${TagKey}	Write
RemoveFromGlobalCluster	Grants permission to detach an Aurora secondary cluster from an Aurora global database cluster or DocumentDB global cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
RemoveFromGlobalCluster		global-cluster*	aws:ResourceTag/${TagKey}	Write
RemoveRoleFromDBCluster	Grants permission to disassociate an Amazon Identity and Access Management (IAM) role from an Amazon Aurora DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
RemoveRoleFromDBInstance	Grants permission to disassociate an Amazon Identity and Access Management (IAM) role from a DB instance	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
RemoveSourceIdentifierFromSubscription	Grants permission to remove a source identifier from an existing RDS event notification subscription	es*	aws:ResourceTag/${TagKey} rds:es-tag/${TagKey}	Write
RemoveTagsFromResource	Grants permission to remove metadata tags from an Amazon RDS resource	auto-backup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}	Tagging, Write
		cev	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
		cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-tag/${TagKey} rds:req-tag/${TagKey}
		cluster-auto-backup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
		cluster-endpoint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
		cluster-pg	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:req-tag/${TagKey}
		cluster-snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-snapshot-tag/${TagKey} rds:req-tag/${TagKey}
		db	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc
		deployment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
		es	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:es-tag/${TagKey} rds:req-tag/${TagKey}
		global-cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
		integration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
		og	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:og-tag/${TagKey} rds:req-tag/${TagKey}
		pg	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:pg-tag/${TagKey} rds:req-tag/${TagKey}
		proxy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
		proxy-endpoint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
		ri	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:ri-tag/${TagKey}
		secgrp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:secgrp-tag/${TagKey}
		shardgrp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:snapshot-tag/${TagKey}
		snapshot-tenant-database	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
		subgrp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey} rds:subgrp-tag/${TagKey}
		target-group	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
		tenant-database	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}
ResetDBClusterParameterGroup	Grants permission to modify the parameters of a DB cluster parameter group to the default value	cluster-pg*	aws:ResourceTag/${TagKey} rds:cluster-pg-tag/${TagKey}	Write
ResetDBParameterGroup	Grants permission to modify the parameters of a DB parameter group to the engine/system default value	pg*	aws:ResourceTag/${TagKey} rds:pg-tag/${TagKey}	Write
RestoreDBClusterFromS3	Grants permission to create an Amazon Aurora DB cluster from data stored in an Amazon S3 bucket	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-tag/${TagKey} rds:DatabaseEngine rds:DatabaseName rds:ManageMasterUserPassword rds:req-tag/${TagKey} rds:StorageEncrypted	Write
		cluster-pg*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:DatabaseEngine rds:DatabaseName rds:ManageMasterUserPassword rds:req-tag/${TagKey} rds:StorageEncrypted
		og*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseEngine rds:DatabaseName rds:ManageMasterUserPassword rds:og-tag/${TagKey} rds:req-tag/${TagKey} rds:StorageEncrypted
		subgrp*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseEngine rds:DatabaseName rds:ManageMasterUserPassword rds:req-tag/${TagKey} rds:StorageEncrypted rds:subgrp-tag/${TagKey}
RestoreDBClusterFromSnapshot	Grants permission to create a new DB cluster from a DB cluster snapshot	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-tag/${TagKey} rds:DatabaseClass rds:Piops rds:req-tag/${TagKey} rds:StorageSize	Write
		cluster-pg*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:DatabaseClass rds:Piops rds:req-tag/${TagKey} rds:StorageSize
		cluster-snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-snapshot-tag/${TagKey} rds:DatabaseClass rds:Piops rds:req-tag/${TagKey} rds:StorageSize
		og*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:og-tag/${TagKey} rds:Piops rds:req-tag/${TagKey} rds:StorageSize
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:Piops rds:req-tag/${TagKey} rds:snapshot-tag/${TagKey} rds:StorageSize
		subgrp*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:Piops rds:req-tag/${TagKey} rds:StorageSize rds:subgrp-tag/${TagKey}
RestoreDBClusterToPointInTime	Grants permission to restore a DB cluster to an arbitrary point in time	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-tag/${TagKey} rds:DatabaseClass rds:Piops rds:req-tag/${TagKey} rds:StorageSize	Write
		cluster-auto-backup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:Piops rds:req-tag/${TagKey} rds:StorageSize
		cluster-pg*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:cluster-pg-tag/${TagKey} rds:DatabaseClass rds:Piops rds:req-tag/${TagKey} rds:StorageSize
		og*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:og-tag/${TagKey} rds:Piops rds:req-tag/${TagKey} rds:StorageSize
		subgrp*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:Piops rds:req-tag/${TagKey} rds:StorageSize rds:subgrp-tag/${TagKey}
RestoreDBInstanceFromDBSnapshot	Grants permission to create a new DB instance from a DB snapshot	cluster-snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:cluster-snapshot-tag/${TagKey} rds:ManageMasterUserPassword rds:PubliclyAccessible rds:req-tag/${TagKey}	Write
		db*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:ManageMasterUserPassword rds:MultiAz rds:Piops rds:PubliclyAccessible rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc
		og*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:ManageMasterUserPassword rds:og-tag/${TagKey} rds:PubliclyAccessible rds:req-tag/${TagKey}
		pg*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:ManageMasterUserPassword rds:pg-tag/${TagKey} rds:PubliclyAccessible rds:req-tag/${TagKey}
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:ManageMasterUserPassword rds:PubliclyAccessible rds:req-tag/${TagKey} rds:snapshot-tag/${TagKey}
		subgrp*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:ManageMasterUserPassword rds:PubliclyAccessible rds:req-tag/${TagKey} rds:subgrp-tag/${TagKey}
RestoreDBInstanceFromS3	Grants permission to create a new DB instance from an Amazon S3 bucket	db*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:ManageMasterUserPassword rds:MultiAz rds:Piops rds:PubliclyAccessible rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
		og*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:ManageMasterUserPassword rds:og-tag/${TagKey} rds:PubliclyAccessible rds:req-tag/${TagKey}
		pg*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:ManageMasterUserPassword rds:pg-tag/${TagKey} rds:PubliclyAccessible rds:req-tag/${TagKey}
		secgrp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:ManageMasterUserPassword rds:PubliclyAccessible rds:req-tag/${TagKey} rds:secgrp-tag/${TagKey}
		subgrp*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:ManageMasterUserPassword rds:PubliclyAccessible rds:req-tag/${TagKey} rds:subgrp-tag/${TagKey}
RestoreDBInstanceToPointInTime	Grants permission to restore a DB instance to an arbitrary point in time	auto-backup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:ManageMasterUserPassword rds:PubliclyAccessible rds:req-tag/${TagKey}	Write
		db*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:ManageMasterUserPassword rds:MultiAz rds:Piops rds:PubliclyAccessible rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc
		og*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:ManageMasterUserPassword rds:og-tag/${TagKey} rds:PubliclyAccessible rds:req-tag/${TagKey}
		pg*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:ManageMasterUserPassword rds:pg-tag/${TagKey} rds:PubliclyAccessible rds:req-tag/${TagKey}
		subgrp*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:BackupTarget rds:ManageMasterUserPassword rds:PubliclyAccessible rds:req-tag/${TagKey} rds:subgrp-tag/${TagKey}
RevokeDBSecurityGroupIngress	Grants permission to revoke ingress from a DBSecurityGroup for previously authorized IP ranges or EC2 or VPC Security Groups	secgrp*	aws:ResourceTag/${TagKey} rds:secgrp-tag/${TagKey}	Write
StartActivityStream	Grants permission to start Activity Stream	cluster	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
StartActivityStream	Grants permission to start Activity Stream	db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
StartDBCluster	Grants permission to start the DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
StartDBInstance	Grants permission to start the DB instance	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
StartDBInstanceAutomatedBackupsReplication	Grants permission to start replication of automated backups to a different Amazon Web Services Region	auto-backup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:req-tag/${TagKey}	Write
StartDBInstanceAutomatedBackupsReplication		db*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:req-tag/${TagKey} rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
StartExportTask	Grants permission to start a new Export task for a DB snapshot	cluster	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
		cluster-snapshot	aws:ResourceTag/${TagKey} rds:cluster-snapshot-tag/${TagKey}
		snapshot	aws:ResourceTag/${TagKey} rds:snapshot-tag/${TagKey}
StopActivityStream	Grants permission to stop Activity Stream	cluster	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
StopActivityStream	Grants permission to stop Activity Stream	db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
StopDBCluster	Grants permission to stop the DB cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
StopDBInstance	Grants permission to stop the DB instance	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
StopDBInstance	Grants permission to stop the DB instance	snapshot	aws:ResourceTag/${TagKey} rds:snapshot-tag/${TagKey}	Write
StopDBInstanceAutomatedBackupsReplication	Grants permission to stop automated backup replication for a DB instance	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write
SwitchoverBlueGreenDeployment	Grants permission to switch a blue-green deployment from source instance or cluster to target	deployment*	aws:ResourceTag/${TagKey}	Write
SwitchoverGlobalCluster	Grants permission to switchover a global cluster	cluster*	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}	Write
SwitchoverGlobalCluster	Grants permission to switchover a global cluster	global-cluster*	aws:ResourceTag/${TagKey}	Write
SwitchoverReadReplica	Grants permission to switch over a read replica, making it the new primary database	db*	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc	Write

Permission-only actions for Amazon RDS

The following actions are defined by Amazon RDS but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CopyCustomDBEngineVersion	Grants permission to copy a custom engine version	cev*	aws:ResourceTag/${TagKey}	Write
CrossRegionCommunication	Grants permission to access a resource in the remote Region when executing cross-Region operations, such as cross-Region snapshot copy or cross-Region read replica creation	cluster-snapshot	aws:ResourceTag/${TagKey} rds:cluster-snapshot-tag/${TagKey}	Write
		db	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:db-tag/${TagKey} rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc
		snapshot	aws:ResourceTag/${TagKey} rds:snapshot-tag/${TagKey}
DescribeRecommendationGroups	Grants permission to return information about recommendation groups			Read
DescribeRecommendations	Grants permission to return information about recommendations			Read
ModifyRecommendation	Grants permission to modify recommendation			Write

Resource types defined by Amazon RDS

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
auto-backup	arn:${Partition}:rds:${Region}:${Account}:auto-backup:${DbInstanceAutomatedBackupId}	aws:ResourceTag/${TagKey}
cev	arn:${Partition}:rds:${Region}:${Account}:cev:${Engine}/${EngineVersion}/${CustomDbEngineVersionId}	aws:ResourceTag/${TagKey}
cluster	arn:${Partition}:rds:${Region}:${Account}:cluster:${DbClusterInstanceName}	aws:ResourceTag/${TagKey} rds:cluster-tag/${TagKey}
cluster-auto-backup	arn:${Partition}:rds:${Region}:${Account}:cluster-auto-backup:${DbClusterAutomatedBackupId}	aws:ResourceTag/${TagKey}
cluster-endpoint	arn:${Partition}:rds:${Region}:${Account}:cluster-endpoint:${DbClusterEndpoint}	aws:ResourceTag/${TagKey}
cluster-pg	arn:${Partition}:rds:${Region}:${Account}:cluster-pg:${ClusterParameterGroupName}	aws:ResourceTag/${TagKey} rds:cluster-pg-tag/${TagKey}
cluster-snapshot	arn:${Partition}:rds:${Region}:${Account}:cluster-snapshot:${ClusterSnapshotName}	aws:ResourceTag/${TagKey} rds:cluster-snapshot-tag/${TagKey}
db	arn:${Partition}:rds:${Region}:${Account}:db:${DbInstanceName}	aws:ResourceTag/${TagKey} rds:DatabaseClass rds:DatabaseEngine rds:DatabaseName rds:MultiAz rds:Piops rds:StorageEncrypted rds:StorageSize rds:Vpc rds:db-tag/${TagKey}
deployment	arn:${Partition}:rds:${Region}:${Account}:deployment:${BlueGreenDeploymentIdentifier}	aws:ResourceTag/${TagKey}
es	arn:${Partition}:rds:${Region}:${Account}:es:${SubscriptionName}	aws:ResourceTag/${TagKey} rds:es-tag/${TagKey}
global-cluster	arn:${Partition}:rds::${Account}:global-cluster:${GlobalCluster}	aws:ResourceTag/${TagKey}
integration	arn:${Partition}:rds:${Region}:${Account}:integration:${IntegrationIdentifier}	aws:ResourceTag/${TagKey}
og	arn:${Partition}:rds:${Region}:${Account}:og:${OptionGroupName}	aws:ResourceTag/${TagKey} rds:og-tag/${TagKey}
pg	arn:${Partition}:rds:${Region}:${Account}:pg:${ParameterGroupName}	aws:ResourceTag/${TagKey} rds:pg-tag/${TagKey}
proxy	arn:${Partition}:rds:${Region}:${Account}:db-proxy:${DbProxyId}	aws:ResourceTag/${TagKey}
proxy-endpoint	arn:${Partition}:rds:${Region}:${Account}:db-proxy-endpoint:${DbProxyEndpointId}	aws:ResourceTag/${TagKey}
ri	arn:${Partition}:rds:${Region}:${Account}:ri:${ReservedDbInstanceName}	aws:ResourceTag/${TagKey} rds:ri-tag/${TagKey}
secgrp	arn:${Partition}:rds:${Region}:${Account}:secgrp:${SecurityGroupName}	aws:ResourceTag/${TagKey} rds:secgrp-tag/${TagKey}
shardgrp	arn:${Partition}:rds:${Region}:${Account}:shard-group:${DbShardGroupResourceId}	aws:ResourceTag/${TagKey}
snapshot	arn:${Partition}:rds:${Region}:${Account}:snapshot:${SnapshotName}	aws:ResourceTag/${TagKey} rds:snapshot-tag/${TagKey}
snapshot-tenant-database	arn:${Partition}:rds:${Region}:${Account}:snapshot-tenant-database:${SnapshotName}:${TenantResourceId}	aws:ResourceTag/${TagKey}
subgrp	arn:${Partition}:rds:${Region}:${Account}:subgrp:${SubnetGroupName}	aws:ResourceTag/${TagKey} rds:subgrp-tag/${TagKey}
target-group	arn:${Partition}:rds:${Region}:${Account}:target-group:${TargetGroupId}	aws:ResourceTag/${TagKey}
tenant-database	arn:${Partition}:rds:${Region}:${Account}:tenant-database:${TenantResourceId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon RDS

Amazon RDS defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the set of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by the set of tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the set of tag keys in the request	ArrayOfString
rds:BackupTarget	Filters access by the type of backup target. One of: region, outposts	String
rds:CopyOptionGroup	Filters access by the value that specifies whether the CopyDBSnapshot action requires copying the DB option group	Bool
rds:DatabaseClass	Filters access by the type of DB instance class	String
rds:DatabaseEngine	Filters access by the database engine. For possible values refer to the engine parameter in CreateDBInstance API	String
rds:DatabaseName	Filters access by the user-defined name of the database on the DB instance	String
rds:EndpointType	Filters access by the type of the endpoint. One of: READER, WRITER, CUSTOM	String
rds:ManageMasterUserPassword	Filters access by the value that specifies whether RDS manages master user password in Amazon Secrets Manager for the DB instance or cluster	Bool
rds:MultiAz	Filters access by the value that specifies whether the DB instance runs in multiple Availability Zones. To indicate that the DB instance is using Multi-AZ, specify true	Bool
rds:Piops	Filters access by the value that contains the number of Provisioned IOPS (PIOPS) that the instance supports. To indicate a DB instance that does not have PIOPS enabled, specify 0	Numeric
rds:PubliclyAccessible	Filters access by the value that specifies whether the DB Instance or DB ShardGroup is publicly accessible	Bool
rds:StorageEncrypted	Filters access by the value that specifies whether the DB instance storage should be encrypted. To enforce storage encryption, specify true	Bool
rds:StorageSize	Filters access by the storage volume size (in GB)	Numeric
rds:TagsFromRequest	Filters access for rds:AddTagsToResource based on whether tags are explicitly specified in the Tags or TagSpecification request parameters. Evaluates to true when tags are provided in these parameters. Evaluates as false when tags are implicitly inherited from source resources	Bool
rds:TenantDatabaseName	Filters access by the tenant database name in CreateTenantDatabase and by the new tenant database name in ModifyTenantDatabase	String
rds:Vpc	Filters access by the value that specifies whether the DB instance runs in an Amazon Virtual Private Cloud (Amazon VPC). To indicate that the DB instance runs in an Amazon VPC, specify true	Bool
rds:cluster-pg-tag/${TagKey}	Filters access by the tag attached to a DB cluster parameter group	String
rds:cluster-snapshot-tag/${TagKey}	Filters access by the tag attached to a DB cluster snapshot	String
rds:cluster-tag/${TagKey}	Filters access by the tag attached to a DB cluster	String
rds:db-tag/${TagKey}	Filters access by the tag attached to a DB instance	String
rds:es-tag/${TagKey}	Filters access by the tag attached to an event subscription	String
rds:og-tag/${TagKey}	Filters access by the tag attached to a DB option group	String
rds:pg-tag/${TagKey}	Filters access by the tag attached to a DB parameter group	String
rds:req-tag/${TagKey}	Filters access by the set of tag keys and values that can be used to tag a resource	String
rds:ri-tag/${TagKey}	Filters access by the tag attached to a reserved DB instance	String
rds:secgrp-tag/${TagKey}	Filters access by the tag attached to a DB security group	String
rds:snapshot-tag/${TagKey}	Filters access by the tag attached to a DB snapshot	String
rds:subgrp-tag/${TagKey}	Filters access by the tag attached to a DB subnet group	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon QuickSight (quicksight)

Amazon RDS IAM Authentication (rds-db)