AWS RDS CLI: AccessDenied on CreateDBSnapshot

Question

I want to use the AWS RDS command line tool to create a snapshot of my database my-database using create-db-snapshot.

I have created a special backup role in IAM with a policy that allows me to describe, copy and create snapshots. It looks like this (I've replaced sensitive id's with an x):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmtxxxxxxxxxxxxxx",
      "Effect": "Allow",
      "Action": [
        "rds:CopyDBSnapshot",
        "rds:CreateDBSnapshot",
        "rds:DescribeDBSnapshots",
        "rds:DescribeEventCategories",
        "rds:DescribeEvents"
      ],
      "Resource": [
        "arn:aws:rds:eu-west-1:xxxxxxxxxxxxxx:db:my-database"
      ]
    }
  ]
}

After configuring the CLI tools with aws configure and entering the keys for this user I tried to make a snapshot by executing this command:

aws rds create-db-snapshot \
    --db-snapshot-identifier "my-database-backup-$(date +%d-%m-%Y-%Hh%Mm)" \
    --db-instance-identifier "my-database"

This results in an error message saying:

A client error (AccessDenied) occurred when calling the CreateDBSnapshot operation: User: arn:aws:iam::xxxxxxxxxxxxxx:user/automated-tasks is not authorized to perform: rds:CreateDBSnapshot on resource: arn:aws:rds:eu-west-1:xxxxxxxxxxxxxx:snapshot:my-database-backup-24-11-2014-11h07m

I thought this was weird, as it says access is denied to the resource with the name I've specified for the --db-snapshot-identifier argument, as apposed to the --db-instance-identifier argument.

If I have sufficient permissions to create a snapshot applied to an instance in the first place, shouldn't the I inherently have create-permissions for that snapshot?

Anyway, I tried changing the resource in the policy to everything within RDS:

"Resource": [
    "arn:aws:rds:eu-west-1:xxxxxxxxxxxxxx:*"
]

I'd hoped this would work because now my role has create-snapshot permissions for everything within the RDS ARN of my account, but it didn't.

Does anyone have a clue as to why my command returns an error?

Answer 1

It is indeed strange, but it appears that the CreateDBSnapshot permission also has to be assigned to the destination snapshot.

This policy works:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmtxxxxxxxxxxxxxx",
            "Effect": "Allow",
            "Action": [
                "rds:CreateDBSnapshot"
            ],
            "Resource": [
                "arn:aws:rds:eu-west-1:xxxxxxxxxxxxxx:db:my-database",
                "arn:aws:rds:eu-west-1:xxxxxxxxxxxxxx:snapshot:*"
            ]
        }
    ]
}