AmazonRDSReadOnlyAccess

Summary

Provides read only access to Amazon RDS via the AWS Management Console. The Amazon RDS User Guide says it allows principals to describe Amazon RDS resources and list their tags, and to read related CloudWatch, Amazon EC2, CloudWatch Logs and DevOps Guru information.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccessCopy ARN

Default version

v7

Created

2015-02-06

Last edited

2023-04-14

Services

cloudwatch, devops-guru, ec2, logs, rds

Control-plane actions (62)

By access level: 57 List, 5 Read.

Data-plane actions (3)

By access level: 1 List, 2 Read.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants only List and Read actions.

Guidance

Related policies

Same service

• AdministratorAccess-AWSElasticBeanstalk
• AIDevOpsReleaseManagementVPCPolicy
• AmazonAppStreamServiceAccess
• AmazonBioDiscoveryServiceLinkedRolePolicy
• AmazonDataZoneEnvironmentRolePermissionsBoundary
• AmazonDataZoneProjectDeploymentPermissionsBoundary
• AmazonDataZoneProjectRolePermissionsBoundary
• AmazonDataZoneSageMakerProvisioningRolePolicy

Same domain

• AmazonAuroraDSQLConsoleFullAccess
• AmazonAuroraDSQLFullAccess
• AmazonAuroraDSQLReadOnlyAccess
• AmazonDocDBConsoleFullAccess
• AmazonDocDBElasticFullAccess
• AmazonDocDBElasticReadOnlyAccess
• AmazonDocDBFullAccess
• AmazonDocDBReadOnlyAccess

Frequently asked questions

When should I attach AmazonRDSReadOnlyAccess?

The Amazon RDS User Guide says it allows read-only access to Amazon RDS through the AWS Management Console. Attach it where viewing RDS resources is the intended scope.

What does AmazonRDSReadOnlyAccess grant?

It allows rds:Describe* and rds:ListTagsForResource, Amazon EC2 describe actions for networking resources, CloudWatch metric reads, CloudWatch Logs log stream and event reads, and DevOps Guru reads, on all resources.

What are the security risks of AmazonRDSReadOnlyAccess?

It has no write actions for Amazon RDS, but logs:GetLogEvents applies to all resources, so the user can read log events beyond RDS. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:Describe*",
        "rds:ListTagsForResource",
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcAttribute",
        "ec2:DescribeVpcs"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "cloudwatch:GetMetricData",
        "logs:DescribeLogStreams",
        "logs:GetLogEvents",
        "devops-guru:GetResourceCollection"
      ],
      "Resource": "*"
    },
    {
      "Action": [
        "devops-guru:SearchInsights",
        "devops-guru:ListAnomaliesForInsight"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "devops-guru:ServiceNames": [
            "RDS"
          ]
        },
        "Null": {
          "devops-guru:ServiceNames": "false"
        }
      }
    }
  ]
}

Version history

Current version v7, edited by AWS on 2023-04-14. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess

resource "aws_iam_role_policy_attachment" "amazonrdsreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonRDSReadOnlyAccess"),
);

Sources

• AmazonRDSReadOnlyAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-12; supports summary, practicalScope, securityConsiderations, assignmentGuidance, faqs)
• Identity and access management for Amazon RDS: AWS managed policies (Amazon RDS User Guide) (retrieved 2026-11-12; supports summary, useCases, assignmentGuidance, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)

• Official AWS reference for AmazonRDSReadOnlyAccess
• AWS service guide
• Report a data issue