Access denied to rds:CreateDBInstance

Based on the error message you've provided, it appears you're encountering an access denied error while trying to create a database in Amazon RDS. The specific issue is that a Service Control Policy (SCP) is explicitly denying the rds:CreateDBInstance action for your user.

Service Control Policies are a type of policy that can be applied at the AWS Organizations level to control permissions across multiple accounts. In this case, there's an SCP in place that's explicitly denying the ability to create RDS instances, even though you're using an assumed Admin role.

To resolve this issue, you'll need to take the following steps:

1. Contact your AWS account administrator or the person responsible for managing your organization's SCPs.

2. Ask them to review the SCP that's denying the rds:CreateDBInstance action. They may need to modify the SCP to allow this action for your role or for the specific RDS resources you're trying to create.

3. If the SCP cannot be changed, you may need to explore alternative solutions, such as using a different AWS account that isn't subject to this restrictive SCP, or finding a different way to accomplish your task that doesn't involve creating a new RDS instance.

Remember, SCPs are designed to set guardrails for an organization, so there may be valid reasons for this restriction. It's important to understand why the policy is in place before requesting changes.

If you're the administrator and you're unsure about the SCP settings, you may need to review your AWS Organizations configuration and the SCPs applied to your account or organizational unit.
Sources
Troubleshoot access denied error messages - AWS Identity and Access Management