Permissions for IAM policy and Role

Question

I have a cloud account with "RDSFullAccess" and "PowerUser" permissions. Full IAM permissions are blocked by admin I assume for privacy or security.

I need to move files into/from the oracle RDS using S3 bucket and S3 integration.

I created the S3 bucket but I need to create an IAM policy to grant read/write permission for S3 bucket and create an
IAM role and attach the policy to it and then assign the role to the RDS instance. 
What permissions do I need to get granted for doing that and is it possible without full access to IAM?

Accepted Answer

You don't mention which database engine it is, but the example here for giving SQL Server access to S3 should by-and-large have what you need (you may need to tweak a few items for a different DB) https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/User.SQLServer.Options.S3-integration.html

You yourself will need a specific level of privileges within IAM to do that, which it doesn't seem that you have - PowerUserAccess gives you iam:CreateServiceLinkedRole, iam:DeleteServiceLinkedRole & iam:ListRoles which I don't think is enough for you to create a policy and attache to a role. You would need at least iam:CreatePolicy, iam:CreateRole, iam:AttachRolePolicy and maybe others https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentityandaccessmanagementiam.html

Permissions for IAM policy and Role

相關內容