rds:ListTagsForResource

Read

rds:ListTagsForResource is a Read access-level action in the rds service. Grants permission to list all tags on an Amazon RDS resource

Resource types

ARNs that rds:ListTagsForResource can be scoped to in an IAM policy.

arn:${Partition}:rds:${Region}:${Account}:auto-backup:${DbInstanceAutomatedBackupId}

auto-backup

arn:${Partition}:rds:${Region}:${Account}:cev:${Engine}/${EngineVersion}/${CustomDbEngineVersionId}

cev

arn:${Partition}:rds:${Region}:${Account}:cluster:${DbClusterInstanceName}

cluster

arn:${Partition}:rds:${Region}:${Account}:cluster-auto-backup:${DbClusterAutomatedBackupId}

cluster-auto-backup

arn:${Partition}:rds:${Region}:${Account}:cluster-endpoint:${DbClusterEndpoint}

cluster-endpoint

arn:${Partition}:rds:${Region}:${Account}:cluster-pg:${ClusterParameterGroupName}

cluster-pg

arn:${Partition}:rds:${Region}:${Account}:cluster-snapshot:${ClusterSnapshotName}

cluster-snapshot

arn:${Partition}:rds:${Region}:${Account}:db:${DbInstanceName}

arn:${Partition}:rds:${Region}:${Account}:es:${SubscriptionName}

arn:${Partition}:rds::${Account}:global-cluster:${GlobalCluster}

global-cluster

arn:${Partition}:rds:${Region}:${Account}:integration:${IntegrationIdentifier}

integration

arn:${Partition}:rds:${Region}:${Account}:og:${OptionGroupName}

arn:${Partition}:rds:${Region}:${Account}:pg:${ParameterGroupName}

arn:${Partition}:rds:${Region}:${Account}:db-proxy:${DbProxyId}

proxy

arn:${Partition}:rds:${Region}:${Account}:db-proxy-endpoint:${DbProxyEndpointId}

proxy-endpoint

arn:${Partition}:rds:${Region}:${Account}:ri:${ReservedDbInstanceName}

arn:${Partition}:rds:${Region}:${Account}:secgrp:${SecurityGroupName}

secgrp

arn:${Partition}:rds:${Region}:${Account}:shard-group:${DbShardGroupResourceId}

shardgrp

arn:${Partition}:rds:${Region}:${Account}:snapshot:${SnapshotName}

snapshot

arn:${Partition}:rds:${Region}:${Account}:snapshot-tenant-database:${SnapshotName}:${TenantResourceId}

snapshot-tenant-database

arn:${Partition}:rds:${Region}:${Account}:subgrp:${SubnetGroupName}

subgrp

arn:${Partition}:rds:${Region}:${Account}:target-group:${TargetGroupId}

target-group

arn:${Partition}:rds:${Region}:${Account}:tenant-database:${TenantResourceId}

tenant-database

Condition keys

Keys you can use in the Condition block of a policy that grants rds:ListTagsForResource.

aws:ResourceTag/${TagKey} String

Filters access by the set of tag key-value pairs attached to the resource

rds:DatabaseClass String

Filters access by the type of DB instance class

rds:DatabaseEngine String

Filters access by the database engine. For possible values refer to the engine parameter in CreateDBInstance API

rds:DatabaseName String

Filters access by the user-defined name of the database on the DB instance

rds:MultiAz Bool

Filters access by the value that specifies whether the DB instance runs in multiple Availability Zones. To indicate that the DB instance is using Multi-AZ, specify true

rds:Piops Numeric

Filters access by the value that contains the number of Provisioned IOPS (PIOPS) that the instance supports. To indicate a DB instance that does not have PIOPS enabled, specify 0

rds:StorageEncrypted Bool

Filters access by the value that specifies whether the DB instance storage should be encrypted. To enforce storage encryption, specify true

rds:StorageSize Numeric

Filters access by the storage volume size (in GB)

rds:Vpc Bool

Filters access by the value that specifies whether the DB instance runs in an Amazon Virtual Private Cloud (Amazon VPC). To indicate that the DB instance runs in an Amazon VPC, specify true

rds:cluster-pg-tag/${TagKey} String

Filters access by the tag attached to a DB cluster parameter group

rds:cluster-snapshot-tag/${TagKey} String

Filters access by the tag attached to a DB cluster snapshot

rds:cluster-tag/${TagKey} String

Filters access by the tag attached to a DB cluster

rds:db-tag/${TagKey} String

Filters access by the tag attached to a DB instance

rds:es-tag/${TagKey} String

Filters access by the tag attached to an event subscription

rds:og-tag/${TagKey} String

Filters access by the tag attached to a DB option group

rds:pg-tag/${TagKey} String

Filters access by the tag attached to a DB parameter group

rds:ri-tag/${TagKey} String

Filters access by the tag attached to a reserved DB instance

rds:secgrp-tag/${TagKey} String

Filters access by the tag attached to a DB security group

rds:snapshot-tag/${TagKey} String

Filters access by the tag attached to a DB snapshot

rds:subgrp-tag/${TagKey} String

Filters access by the tag attached to a DB subnet group

Example IAM policy

A minimal policy that allows rds:ListTagsForResource. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowRdsListTagsForResource",
      "Effect": "Allow",
      "Action": "rds:ListTagsForResource",
      "Resource": "*"
    }
  ]
}

Related actions in rds

rds:AddRoleToDBCluster Write rds:AddRoleToDBInstance Write rds:AddSourceIdentifierToSubscription Write rds:AddTagsToResource Tagging rds:ApplyPendingMaintenanceAction Write rds:AuthorizeDBSecurityGroupIngress Permissions management rds:BacktrackDBCluster Write rds:CancelExportTask Write rds:CopyCustomDBEngineVersion Write rds:CopyDBClusterParameterGroup Write rds:CopyDBClusterSnapshot Write rds:CopyDBParameterGroup Write

View all rds actions →