rds:CreateDBCluster

Write

rds:CreateDBCluster is a Write access-level action in the rds service. Grants permission to create a new DB cluster

Resource types

ARNs that rds:CreateDBCluster can be scoped to in an IAM policy.

arn:${Partition}:rds:${Region}:${Account}:cluster:${DbClusterInstanceName} required
cluster
arn:${Partition}:rds:${Region}:${Account}:cluster-pg:${ClusterParameterGroupName} required
cluster-pg
arn:${Partition}:rds:${Region}:${Account}:db:${DbInstanceName}
db
arn:${Partition}:rds::${Account}:global-cluster:${GlobalCluster}
global-cluster
arn:${Partition}:rds:${Region}:${Account}:og:${OptionGroupName} required
og
arn:${Partition}:rds:${Region}:${Account}:subgrp:${SubnetGroupName} required
subgrp

Condition keys

Keys you can use in the Condition block of a policy that grants rds:CreateDBCluster.

aws:RequestTag/${TagKey} String

Filters access by the set of tag key-value pairs in the request

aws:TagKeys ArrayOfString

Filters access by the set of tag keys in the request

rds:DatabaseClass String

Filters access by the type of DB instance class

rds:DatabaseEngine String

Filters access by the database engine. For possible values refer to the engine parameter in CreateDBInstance API

rds:DatabaseName String

Filters access by the user-defined name of the database on the DB instance

rds:ManageMasterUserPassword Bool

Filters access by the value that specifies whether RDS manages master user password in AWS Secrets Manager for the DB instance or cluster

rds:Piops Numeric

Filters access by the value that contains the number of Provisioned IOPS (PIOPS) that the instance supports. To indicate a DB instance that does not have PIOPS enabled, specify 0

rds:StorageEncrypted Bool

Filters access by the value that specifies whether the DB instance storage should be encrypted. To enforce storage encryption, specify true

rds:StorageSize Numeric

Filters access by the storage volume size (in GB)

rds:req-tag/${TagKey} String

Filters access by the set of tag keys and values that can be used to tag a resource

aws:ResourceTag/${TagKey} String

Filters access by the set of tag key-value pairs attached to the resource

rds:cluster-tag/${TagKey} String

Filters access by the tag attached to a DB cluster

rds:cluster-pg-tag/${TagKey} String

Filters access by the tag attached to a DB cluster parameter group

rds:MultiAz Bool

Filters access by the value that specifies whether the DB instance runs in multiple Availability Zones. To indicate that the DB instance is using Multi-AZ, specify true

rds:Vpc Bool

Filters access by the value that specifies whether the DB instance runs in an Amazon Virtual Private Cloud (Amazon VPC). To indicate that the DB instance runs in an Amazon VPC, specify true

rds:db-tag/${TagKey} String

Filters access by the tag attached to a DB instance

rds:og-tag/${TagKey} String

Filters access by the tag attached to a DB option group

rds:subgrp-tag/${TagKey} String

Filters access by the tag attached to a DB subnet group

Example IAM policy

A minimal policy that allows rds:CreateDBCluster. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowRdsCreateDBCluster",
      "Effect": "Allow",
      "Action": "rds:CreateDBCluster",
      "Resource": "*"
    }
  ]
}

Related actions in rds

rds:AddRoleToDBCluster Write rds:AddRoleToDBInstance Write rds:AddSourceIdentifierToSubscription Write rds:AddTagsToResource Tagging rds:ApplyPendingMaintenanceAction Write rds:AuthorizeDBSecurityGroupIngress Permissions management rds:BacktrackDBCluster Write rds:CancelDBCapacityReservation Write rds:CancelExportTask Write rds:CopyCustomDBEngineVersion Write rds:CopyDBClusterParameterGroup Write rds:CopyDBClusterSnapshot Write

View all rds actions →