Step 1: Create an IAM policy - Amazon Relational Database Service

Step 1: Create an IAM policy

In this step, you create an AWS Identity and Access Management (IAM) policy with the permissions required to transfer files from your Amazon S3 bucket to your RDS DB instance. This step assumes that you have already created an S3 bucket. For more information, see Creating a bucket in the Amazon S3 User Guide.

Before you create the policy, note the following pieces of information:

  • The Amazon Resource Name (ARN) for your bucket

  • The ARN for your AWS Key Management Service (AWS KMS) key, if your bucket uses SSE-KMS or SSE-S3 encryption.

Create an IAM policy that includes the following permissions:

"kms:GenerateDataKey",
"kms:Decrypt",
"s3:PutObject",
"s3:GetObject",
"s3:AbortMultipartUpload",
"s3:ListBucket",
"s3:DeleteObject",
"s3:GetObjectVersion",
"s3:ListMultipartUploadParts"

You can create an IAM policy by using the AWS Management Console or the AWS Command Line Interface (AWS CLI).

To create an IAM policy to allow Amazon RDS to access your Amazon S3 bucket

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane, choose Policies.

  3. Choose Create policy, and then choose JSON.

  4. Add actions by service. To transfer files from an Amazon S3 bucket to Amazon RDS, you must select bucket permissions and object permissions.

  5. Expand Resources. You must specify your bucket and object resources.

  6. Choose Next.

  7. For Policy name, enter a name for this policy.

  8. (Optional) For Description, enter a description for this policy.

  9. Choose Create policy.

To create an IAM policy to allow Amazon RDS to access your Amazon S3 bucket

  1. Run the create-policy command. In the following example, replace iam_policy_name and s3_bucket_name with a name for your IAM policy and the name of the Amazon S3 bucket where your RDS for Db2 database resides.

    For Linux, macOS, or Unix:

    aws iam create-policy \
    --policy-name iam_policy_name \
    --policy-document '{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "kms:GenerateDataKey",
            "kms:Decrypt",
            "s3:PutObject",
            "s3:GetObject",
            "s3:AbortMultipartUpload",
            "s3:ListBucket",
            "s3:DeleteObject",
            "s3:GetObjectVersion",
            "s3:ListMultipartUploadParts"
          ],
          "Resource": [
            "arn:aws:s3:::s3_bucket_name/*",
            "arn:aws:s3:::s3_bucket_name"
          ]
        }
      ]
    }'

    For Windows:

    aws iam create-policy ^
    --policy-name iam_policy_name ^
    --policy-document '{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
            "Action": [
              "s3:PutObject",
              "s3:GetObject",
              "s3:AbortMultipartUpload",
              "s3:ListBucket",
              "s3:DeleteObject",
              "s3:GetObjectVersion",
              "s3:ListMultipartUploadParts"
            ],
            "Resource": [
              "arn:aws:s3:::s3_bucket_name/*",
              "arn:aws:s3:::s3_bucket_name"
            ]
        }
      ]
    }'

  2. After the policy is created, note the ARN of the policy. You need the ARN for Step 2: Create an IAM role and attach your IAM policy.

For information about creating an IAM policy, see Creating IAM policies in the IAM User Guide.