rds database security.

Hello,

First of all, create an IAM user for you and everyone who will access the AWS account it's recommended not to use root account for performing everyday tasks or recommended best practise is to use federation with an AWS identity provider to access AWS using temporary credentials instead of using IAM users with long-term credentials.

To ensure the project manager can access the RDS database through the console but cannot change the password. Create a policy that deny permissions to modifyDB instance and attach it to the IAM user.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:Describe*",
        "rds:List*"
      ],
      "Resource": "arn:aws:rds:region:account-id:db:hatecholo-db"
    },
    {
      "Effect": "Deny",
      "Action": "rds:ModifyDBInstance",
      "Resource": "arn:aws:rds:region:account-id:db:hatecholo-db"
    }
  ]
}