AWS IAM: Role templates table: add Amazon RDS, drop CloudWatch entries
Summary
Adds six Amazon RDS role templates (including KMS key and secret-backed ones) to the role-template table and removes the CloudWatch-related template rows.
Security assessment
This is a catalog change listing available IAM role templates and their parameters (kmsKeyId, secretId, etc.); it is IAM-adjacent reference content, not documentation of a fix, weakness, or hardening practice.
Evidence
+Amazon RDS | AmazonRDSImportFromS3RoleTemplate | `arn:aws:iam::aws:role-template/rds.amazonaws.com/AmazonRDSImportFromS3RoleTemplate:1` | CUSTOM_KMS_KEY, RoleName, accountId, bucketName, keyAccountId, keyRegion, kmsKeyId, prefix
Diff
diff --git a/IAM/latest/UserGuide/id_roles_create_role-template.md b/IAM/latest/UserGuide/id_roles_create_role-template.md index a4924c6a6..f3e05c8b5 100644 --- a//IAM/latest/UserGuide/id_roles_create_role-template.md +++ b//IAM/latest/UserGuide/id_roles_create_role-template.md @@ -39,0 +40,6 @@ AWS Lambda | PowerUserRoleTemplate | `arn:aws:iam::aws:role-template/iam.amazona +Amazon RDS | AmazonRDSDirectoryServiceIntegrationRoleTemplate | `arn:aws:iam::aws:role-template/rds.amazonaws.com/AmazonRDSDirectoryServiceIntegrationRoleTemplate:1` | RoleName, accountId +Amazon RDS | AmazonRDSExportToS3RoleTemplate | `arn:aws:iam::aws:role-template/rds.amazonaws.com/AmazonRDSExportToS3RoleTemplate:1` | RoleName, accountId, bucketName +Amazon RDS | AmazonRDSImportFromS3RoleTemplate | `arn:aws:iam::aws:role-template/rds.amazonaws.com/AmazonRDSImportFromS3RoleTemplate:1` | CUSTOM_KMS_KEY, RoleName, accountId, bucketName, keyAccountId, keyRegion, kmsKeyId, prefix +Amazon RDS | AmazonRDSMonitoringRoleTemplate | `arn:aws:iam::aws:role-template/rds.amazonaws.com/AmazonRDSMonitoringRoleTemplate:1` | RoleName, accountId +Amazon RDS | AmazonRDSProxyRoleTemplate | `arn:aws:iam::aws:role-template/rds.amazonaws.com/AmazonRDSProxyRoleTemplate:2` | PROXY_WITH_CUSTOM_KEY, PROXY_WITH_DB_CONNECTION, PROXY_WITH_SECRET, RoleName, accountId, dbResourceId, dbUser, keyId, region, secretId +Amazon RDS | AmazonRDSSecretAccessForDMSRoleTemplate | `arn:aws:iam::aws:role-template/rds.amazonaws.com/AmazonRDSSecretAccessForDMSRoleTemplate:1` | CUSTOM_KMS_KEY, RoleName, accountId, kmsKeyId, region, secretId @@ -44,7 +49,0 @@ Amazon CloudWatch | PowerUserRoleTemplate | `arn:aws:iam::aws:role-template/iam. -Amazon CloudWatch | AmazonCloudWatchLogsScheduledQueryExecutionRoleTemplate | `arn:aws:iam::aws:role-template/logs.amazonaws.com/AmazonCloudWatchLogsScheduledQueryExecutionRoleTemplate:1` | RoleName, account, region -Amazon CloudWatch | AmazonCloudWatchMetricStreamsFirehosePutRecordsRoleTemplate | `arn:aws:iam::aws:role-template/streams.metrics.cloudwatch.amazonaws.com/AmazonCloudWatchMetricStreamsFirehosePutRecordsRoleTemplate:1` | RoleName, accountId, deliveryStreamName, region -Amazon CloudWatch | AmazonCloudWatchMetricStreamsFirehoseToS3RoleTemplate | `arn:aws:iam::aws:role-template/firehose.amazonaws.com/AmazonCloudWatchMetricStreamsFirehoseToS3RoleTemplate:1` | RoleName, accountId, bucketName, logGroupName, logStreamName, region -Amazon CloudWatch | AmazonCloudWatchRUMPutEventsRoleTemplate | `arn:aws:iam::aws:role-template/rum.amazonaws.com/AmazonCloudWatchRUMPutEventsRoleTemplate:1` | RoleName, accountId, appMonitor, identityPool, region -Amazon CloudWatch | AmazonCloudWatchSyntheticsExecutionRoleTemplate | `arn:aws:iam::aws:role-template/synthetics.amazonaws.com/AmazonCloudWatchSyntheticsExecutionRoleTemplate:1` | RoleName, account_id, canary_name, region_name, role_uuid -Amazon CloudWatch | AmazonCloudWatchSyntheticsKmsExecutionRoleTemplate | `arn:aws:iam::aws:role-template/synthetics.amazonaws.com/AmazonCloudWatchSyntheticsKmsExecutionRoleTemplate:1` | RoleName, account_id, canary_name, region_name, role_uuid -Amazon CloudWatch | AmazonCloudWatchSyntheticsVpcExecutionRoleTemplate | `arn:aws:iam::aws:role-template/synthetics.amazonaws.com/AmazonCloudWatchSyntheticsVpcExecutionRoleTemplate:1` | RoleName, account_id, canary_name, region_name, role_uuid