DescribeDBCluster permission error when adding datasource


I am trying to add a datasource to my new GraphQl API using the "amplify api add-graphql-datasource" command. I am receiving the following error when I do.

User: arn:aws:sts::101821158090:assumed-role/us-west-2_2vJlh9y73_Full-access/amplifyadmin is not authorized to perform: rds:DescribeDBClusters on resource: arn:aws:rds:us-west-2:101821158090:cluster:* because no identity-based policy allows the rds:DescribeDBClusters action

I can't seem to find the right role with the DescribeDBClusters action.

1 Answer


Fortunately IAM Error messages are straightforward. We can see in the error message is described as "because no identity-based policy allows the rds:DescribeDBClusters action" - which means that the role you were using did not have rds:DescribeDBClusters as a permission in it's IAM policy, for example:

    "Version": "2012-10-17",
    "Statement": [
            "Action": [
            "Effect": "Allow",
            "Resource": "*"

To solve this issue you can do two things:

  1. You can attach an AWS Managed IAM Policy to your role which will grant the permissions needed to perform that action, for example the "AmazonRDSReadOnlyAccess" policy. You can also attach other Managed Policies if you require additional permissions, such as "AmazonRDSFullAccess"
  2. From the IAM console, you can create a new policy [$new?step=edit]. Using either the visual editor, or the JSON editor, you can then specify the permissions you need for accessing your RDS resources.

If you're not sure what permissions are needed, then please have a look at this document:

Hope this helps :)

answered 12 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions