AmazonRDSPerformanceInsightsReadOnly

ReaderAWS managedActivePermissions reviewedShow on map Compare

Summary

Read-Only policy for RDS Performance Insights

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AmazonRDSPerformanceInsightsReadOnly
Default version: v7
Created: 2022-04-05
Last edited: 2026-07-22
Services: pi, rds

Control-plane actions (14)

By access level: 6 List, 8 Read.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
Performance Insights	10 of 14	3 List, 7 Read; 10 restricted, 0 conditional	pi:DescribeDimensionKeys, pi:GetDimensionKeyDetails, pi:GetPerformanceAnalysisReport, pi:GetResourceMetadata, pi:GetResourceMetrics, pi:ListAvailableResourceDimensions, pi:ListAvailableResourceMetrics, pi:ListPerformanceAnalysisReportRecommendations, pi:ListPerformanceAnalysisReports, pi:ListTagsForResource
RDS	4 of 173	3 List, 1 Read; 4 restricted, 0 conditional	rds:DescribeDBClusters, rds:DescribeDBInstances, rds:DescribeDBShardGroups, rds:ListTagsForResource

Performance Insights: 10 actions

pi:DescribeDimensionKeys (Read)
pi:GetDimensionKeyDetails (Read)
pi:GetPerformanceAnalysisReport (Read)
pi:GetResourceMetadata (Read)
pi:GetResourceMetrics (Read)
pi:ListAvailableResourceDimensions (Read)
pi:ListAvailableResourceMetrics (Read)
pi:ListPerformanceAnalysisReportRecommendations (List)
pi:ListPerformanceAnalysisReports (List)
pi:ListTagsForResource (List)

RDS: 4 actions

rds:DescribeDBClusters (List)
rds:DescribeDBInstances (List)
rds:DescribeDBShardGroups (List)
rds:ListTagsForResource (Read)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: scoped.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants only List and Read actions.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AmazonRDSDescribeDBInstances",
      "Effect": "Allow",
      "Action": "rds:DescribeDBInstances",
      "Resource": "arn:aws:rds:*:*:db:*"
    },
    {
      "Sid": "AmazonRDSDescribeDBClusters",
      "Effect": "Allow",
      "Action": "rds:DescribeDBClusters",
      "Resource": "arn:aws:rds:*:*:cluster:*"
    },
    {
      "Sid": "AmazonRDSDescribeDBShardGroups",
      "Effect": "Allow",
      "Action": "rds:DescribeDBShardGroups",
      "Resource": "arn:aws:rds:*:*:shard-group:*"
    },
    {
      "Sid": "AmazonRDSListTagsForResource",
      "Effect": "Allow",
      "Action": "rds:ListTagsForResource",
      "Resource": [
        "arn:aws:rds:*:*:db:*",
        "arn:aws:rds:*:*:shard-group:*",
        "arn:aws:rds:*:*:cluster:*"
      ]
    },
    {
      "Sid": "AmazonRDSPerformanceInsightsDescribeDimensionKeys",
      "Effect": "Allow",
      "Action": "pi:DescribeDimensionKeys",
      "Resource": "arn:aws:pi:*:*:metrics/rds/*"
    },
    {
      "Sid": "AmazonRDSPerformanceInsightsGetDimensionKeyDetails",
      "Effect": "Allow",
      "Action": "pi:GetDimensionKeyDetails",
      "Resource": "arn:aws:pi:*:*:metrics/rds/*"
    },
    {
      "Sid": "AmazonRDSPerformanceInsightsGetResourceMetadata",
      "Effect": "Allow",
      "Action": "pi:GetResourceMetadata",
      "Resource": "arn:aws:pi:*:*:metrics/rds/*"
    },
    {
      "Sid": "AmazonRDSPerformanceInsightsGetResourceMetrics",
      "Effect": "Allow",
      "Action": "pi:GetResourceMetrics",
      "Resource": "arn:aws:pi:*:*:metrics/rds/*"
    },
    {
      "Sid": "AmazonRDSPerformanceInsightsListAvailableResourceDimensions",
      "Effect": "Allow",
      "Action": "pi:ListAvailableResourceDimensions",
      "Resource": "arn:aws:pi:*:*:metrics/rds/*"
    },
    {
      "Sid": "AmazonRDSPerformanceInsightsListAvailableResourceMetrics",
      "Effect": "Allow",
      "Action": "pi:ListAvailableResourceMetrics",
      "Resource": "arn:aws:pi:*:*:metrics/rds/*"
    },
    {
      "Sid": "AmazonRDSPerformanceInsightsGetPerformanceAnalysisReport",
      "Effect": "Allow",
      "Action": "pi:GetPerformanceAnalysisReport",
      "Resource": "arn:aws:pi:*:*:perf-reports/rds/*/*"
    },
    {
      "Sid": "AmazonRDSPerformanceInsightsListPerformanceAnalysisReportRecommendations",
      "Effect": "Allow",
      "Action": "pi:ListPerformanceAnalysisReportRecommendations",
      "Resource": "arn:aws:pi:*:*:perf-reports/rds/*/*"
    },
    {
      "Sid": "AmazonRDSPerformanceInsightsListPerformanceAnalysisReports",
      "Effect": "Allow",
      "Action": "pi:ListPerformanceAnalysisReports",
      "Resource": "arn:aws:pi:*:*:perf-reports/rds/*/*"
    },
    {
      "Sid": "AmazonRDSPerformanceInsightsListTagsForResource",
      "Effect": "Allow",
      "Action": "pi:ListTagsForResource",
      "Resource": "arn:aws:pi:*:*:*/rds/*"
    }
  ]
}

Version history

Current version v7, edited by AWS on 2026-07-22. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonRDSPerformanceInsightsReadOnly
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonRDSPerformanceInsightsReadOnly
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonRDSPerformanceInsightsReadOnly

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonRDSPerformanceInsightsReadOnly

Terraform

resource "aws_iam_role_policy_attachment" "amazonrdsperformanceinsightsreadonly" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonRDSPerformanceInsightsReadOnly"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonRDSPerformanceInsightsReadOnly"),
);

Sources

Pending editorial review. No editorial sources are listed yet.