- Newest
- Most votes
- Most comments
The error message you're encountering suggests that there's an issue with the IAM role configuration for exporting your RDS database to Amazon S3. To resolve this, you need to ensure that the IAM role is properly set up to allow the RDS export service to assume it. Here are the steps to correct this issue:
-
Verify that the IAM role "export-rds-db-s3" exists in your AWS account. If it doesn't, you'll need to create it.
-
Modify the trust relationship of the IAM role to allow the RDS export service to assume it. The trust policy should include the following:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "export.rds.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
Note that the service principal should be "export.rds.amazonaws.com", not "rds.amazonaws.com".
-
Ensure that the role has the necessary permissions to access S3 and Glue. While you mentioned you've given S3 full access and Glue console full access, it's generally recommended to limit permissions to only what's necessary for the export operation.
-
Add a condition to the trust relationship to enhance security. You can use the "aws:SourceArn" and "aws:SourceAccount" condition keys to limit which RDS resources can assume the role.
-
After making these changes, try the export operation again.
If you continue to face issues, double-check that the role name and ARN are correct in your export command or console settings. Also, ensure that you have the necessary permissions to perform the export operation itself.
Remember, it's a best practice to follow the principle of least privilege when setting up IAM roles and policies. Consider refining the permissions to only what's strictly necessary for the export operation rather than granting full access to services.
Sources
Exporting DB snapshot data to Amazon S3 for Amazon RDS - Amazon Relational Database Service
Setting up access to an Amazon S3 bucket - Amazon Relational Database Service
Relevant content
asked 8 months ago
