0

I want to use the AWS RDS command line tool to create a snapshot of my database my-database using create-db-snapshot.

I have created a special backup role in IAM with a policy that allows me to describe, copy and create snapshots. It looks like this (I've replaced sensitive id's with an x):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmtxxxxxxxxxxxxxx",
      "Effect": "Allow",
      "Action": [
        "rds:CopyDBSnapshot",
        "rds:CreateDBSnapshot",
        "rds:DescribeDBSnapshots",
        "rds:DescribeEventCategories",
        "rds:DescribeEvents"
      ],
      "Resource": [
        "arn:aws:rds:eu-west-1:xxxxxxxxxxxxxx:db:my-database"
      ]
    }
  ]
}

After configuring the CLI tools with aws configure and entering the keys for this user I tried to make a snapshot by executing this command:

aws rds create-db-snapshot \
    --db-snapshot-identifier "my-database-backup-$(date +%d-%m-%Y-%Hh%Mm)" \
    --db-instance-identifier "my-database"

This results in an error message saying:

A client error (AccessDenied) occurred when calling the CreateDBSnapshot operation: User: arn:aws:iam::xxxxxxxxxxxxxx:user/automated-tasks is not authorized to perform: rds:CreateDBSnapshot on resource: arn:aws:rds:eu-west-1:xxxxxxxxxxxxxx:snapshot:my-database-backup-24-11-2014-11h07m

I thought this was weird, as it says access is denied to the resource with the name I've specified for the --db-snapshot-identifier argument, as apposed to the --db-instance-identifier argument.

If I have sufficient permissions to create a snapshot applied to an instance in the first place, shouldn't the I inherently have create-permissions for that snapshot?

Anyway, I tried changing the resource in the policy to everything within RDS:

"Resource": [
    "arn:aws:rds:eu-west-1:xxxxxxxxxxxxxx:*"
]

I'd hoped this would work because now my role has create-snapshot permissions for everything within the RDS ARN of my account, but it didn't.

Does anyone have a clue as to why my command returns an error?

1

It is indeed strange, but it appears that the CreateDBSnapshot permission also has to be assigned to the destination snapshot.

This policy works:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmtxxxxxxxxxxxxxx",
            "Effect": "Allow",
            "Action": [
                "rds:CreateDBSnapshot"
            ],
            "Resource": [
                "arn:aws:rds:eu-west-1:xxxxxxxxxxxxxx:db:my-database",
                "arn:aws:rds:eu-west-1:xxxxxxxxxxxxxx:snapshot:*"
            ]
        }
    ]
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.