AmazonRDSCustomInstanceProfileRolePolicy
Last Modified
Mar 12, 2026
March 12, 2026 at 09:28 PM UTC
Version
v4
Total Versions
2
Created
Feb 12, 2026
Actions
47
Risk
no risk signalRead from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
IAM Access Analyzer (2)
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ssmAgentPermission1",
"Effect": "Allow",
"Action": [
"ssm:UpdateInstanceInformation"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "ssmAgentPermission2",
"Effect": "Allow",
"Action": [
"ssm:GetManifest",
"ssm:PutConfigurePackageResult"
],
"Resource": "*"
},
{
"Sid": "ssmAgentPermission3",
"Effect": "Allow",
"Action": [
"ssm:GetDocument",
"ssm:DescribeDocument"
],
"Resource": "arn:aws:ssm:*:*:document/*"
},
{
"Sid": "ssmAgentPermission4",
"Effect": "Allow",
"Action": [
"ssmmessages:CreateControlChannel",
"ssmmessages:OpenControlChannel"
],
"Resource": "*"
},
{
"Sid": "ssmAgentPermission5",
"Effect": "Allow",
"Action": [
"ec2messages:AcknowledgeMessage",
"ec2messages:DeleteMessage",
"ec2messages:FailMessage",
"ec2messages:GetEndpoint",
"ec2messages:GetMessages",
"ec2messages:SendReply"
],
"Resource": "*"
},
{
"Sid": "createEc2SnapshotPermission1",
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot",
"ec2:CreateSnapshots"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "createEc2SnapshotPermission2",
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot",
"ec2:CreateSnapshots"
],
"Resource": [
"arn:aws:ec2:*::snapshot/*"
],
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "createEc2SnapshotPermission3",
"Effect": "Allow",
"Action": "ec2:CreateSnapshots",
"Resource": [
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "createTagForEc2SnapshotPermission",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": "*",
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
],
"ec2:CreateAction": [
"CreateSnapshot",
"CreateSnapshots"
]
}
}
},
{
"Sid": "rdsCustomS3ObjectPermission",
"Effect": "Allow",
"Action": [
"s3:putObject",
"s3:getObject",
"s3:getObjectVersion",
"s3:AbortMultipartUpload",
"s3:ListMultipartUploadParts"
],
"Resource": [
"arn:aws:s3:::do-not-delete-rds-custom-*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "rdsCustomS3BucketPermission",
"Effect": "Allow",
"Action": [
"s3:ListBucketVersions",
"s3:ListBucketMultipartUploads"
],
"Resource": [
"arn:aws:s3:::do-not-delete-rds-custom-*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "readSecretsFromCpPermission",
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue",
"secretsmanager:DescribeSecret"
],
"Resource": [
"arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*",
"arn:aws:secretsmanager:*:*:secret:rds-custom!*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "createSecretsOnDpPermission",
"Effect": "Allow",
"Action": [
"secretsmanager:CreateSecret",
"secretsmanager:TagResource"
],
"Resource": [
"arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*"
],
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": "custom-oracle-rac"
}
}
},
{
"Sid": "publishCwMetricsPermission",
"Effect": "Allow",
"Action": "cloudwatch:PutMetricData",
"Resource": "*",
"Condition": {
"StringEquals": {
"cloudwatch:namespace": [
"rdscustom/rds-custom-sqlserver-agent",
"RDSCustomForOracle/Agent"
]
}
}
},
{
"Sid": "putEventsToEventBusPermission",
"Effect": "Allow",
"Action": "events:PutEvents",
"Resource": "arn:aws:events:*:*:event-bus/default"
},
{
"Sid": "cwlUploadPermission",
"Effect": "Allow",
"Action": [
"logs:PutRetentionPolicy",
"logs:PutLogEvents",
"logs:DescribeLogStreams",
"logs:CreateLogStream",
"logs:CreateLogGroup"
],
"Resource": "arn:aws:logs:*:*:log-group:rds-custom-instance-*"
},
{
"Sid": "sendMessageToSqsQueuePermission",
"Effect": "Allow",
"Action": [
"sqs:SendMessage",
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:GetQueueUrl"
],
"Resource": [
"arn:aws:sqs:*:*:do-not-delete-rds-custom-*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": "custom-sqlserver"
}
}
},
{
"Sid": "managePrivateIpOnEniPermission",
"Effect": "Allow",
"Action": [
"ec2:AssignPrivateIpAddresses",
"ec2:UnassignPrivateIpAddresses"
],
"Resource": "arn:aws:ec2:*:*:network-interface/*",
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": "custom-oracle-rac"
}
}
},
{
"Sid": "kmsPermissionWithSecret",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "*",
"Condition": {
"ArnLike": {
"kms:EncryptionContext:SecretARN": [
"arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*",
"arn:aws:secretsmanager:*:*:secret:rds-custom!*"
]
},
"StringLike": {
"kms:ViaService": "secretsmanager.*.amazonaws.com"
}
}
},
{
"Sid": "kmsPermissionWithS3",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "*",
"Condition": {
"ArnLike": {
"kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::do-not-delete-rds-custom-*"
},
"StringLike": {
"kms:ViaService": "s3.*.amazonaws.com"
}
}
}
]
},
"VersionId": "v4",
"IsDefaultVersion": true,
"CreateDate": "2026-02-12T18:00:17+00:00"
}
}Version History (7 recorded)
Raw historyAmazonRDSCustomInstanceProfileRolePolicy - Policy Version v4
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
b6b3719AmazonRDSCustomInstanceProfileRolePolicy - Policy Version v4
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
16bd36eAmazonRDSCustomInstanceProfileRolePolicy - Policy Version v3
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
4bdb318Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 20, 2025
1a75a22Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 27, 2024
bdaac50