When should I attach DatabaseAdministrator?

Attach it to a user who sets up, configures and maintains databases in the AWS Cloud. It is the Database administrator job function, which AWS designed to align with a common job function in the IT industry.

What are the security risks of DatabaseAdministrator?

Most actions apply to all resources and include full access to several database services and delete actions such as s3:DeleteObject* and lambda:DeleteFunction. It allows iam:PassRole, limited to the named roles. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

DatabaseAdministrator

High privilegeAdminJob functionActiveReviewedShow on map Compare

Summary

A job function policy that grants full access permissions to AWS services and actions required to set up and configure AWS database services.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN: arn:aws:iam::aws:policy/job-function/DatabaseAdministrator
Default version: v5
Created: 2016-11-10
Last edited: 2026-02-12
Services: cloudwatch, datapipeline, dynamodb, ec2, elasticache, iam, kms, lambda, logs, pi, rds, redshift, s3, sns

Control-plane actions (715)

By access level: 154 List, 18 Permissions management, 188 Read, 12 Tagging, 343 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudWatch	69 of 160	24 List, 41 Read, 4 Write; 0 restricted, 0 conditional	cloudwatch:DeleteAlarms, cloudwatch:Describe, cloudwatch:DisableAlarmActions, cloudwatch:EnableAlarmActions, cloudwatch:Get, cloudwatch:List*, cloudwatch:PutMetricAlarm
Data Pipeline	9 of 21	1 List, 4 Read, 4 Write; 0 restricted, 0 conditional	datapipeline:ActivatePipeline, datapipeline:CreatePipeline, datapipeline:DeletePipeline, datapipeline:DescribeObjects, datapipeline:DescribePipelines, datapipeline:GetPipelineDefinition, datapipeline:ListPipelines, datapipeline:PutPipelineDefinition, datapipeline:QueryObjects
DynamoDB	All 68 actions (see the DynamoDB page)	7 List, 3 Permissions management, 22 Read, 2 Tagging, 34 Write; 0 restricted, 0 conditional	dynamodb:*
EC2	7 of 834	7 List; 0 restricted, 0 conditional	ec2:DescribeAccountAttributes, ec2:DescribeAddresses, ec2:DescribeAvailabilityZones, ec2:DescribeInternetGateways, ec2:DescribeSecurityGroups, ec2:DescribeSubnets, ec2:DescribeVpcs
ElastiCache	All 77 actions (see the ElastiCache page)	20 List, 1 Read, 2 Tagging, 54 Write; 0 restricted, 0 conditional	elasticache:*
IAM	3 of 190	1 List, 1 Read, 1 Write; 1 restricted, 0 conditional	iam:GetRole, iam:ListRoles, iam:PassRole
KMS	1 of 58	1 List; 0 restricted, 0 conditional	kms:ListKeys
Lambda	7 of 121	2 List, 1 Read, 4 Write; 0 restricted, 0 conditional	lambda:CreateEventSourceMapping, lambda:CreateFunction, lambda:DeleteEventSourceMapping, lambda:DeleteFunction, lambda:GetFunctionConfiguration, lambda:ListEventSourceMappings, lambda:ListFunctions
CloudWatch Logs	15 of 133	2 List, 2 Read, 11 Write; 0 restricted, 0 conditional	logs:Create*, logs:DescribeLogGroups, logs:DescribeLogStreams, logs:FilterLogEvents, logs:GetLogEvents, logs:PutLogEvents, logs:PutMetricFilter
Performance Insights	13 of 14	2 List, 7 Read, 2 Tagging, 2 Write; 0 restricted, 0 conditional	pi:CreatePerformanceAnalysisReport, pi:DeletePerformanceAnalysisReport, pi:DescribeDimensionKeys, pi:GetDimensionKeyDetails, pi:GetPerformanceAnalysisReport, pi:GetResourceMetadata, pi:GetResourceMetrics, pi:ListAvailableResourceDimensions, pi:ListAvailableResourceMetrics, pi:ListPerformanceAnalysisReports, pi:ListTagsForResource, pi:TagResource and 1 more
RDS	All 173 actions (see the RDS page)	47 List, 1 Permissions management, 5 Read, 2 Tagging, 118 Write; 0 restricted, 0 conditional	rds:*
Redshift	All 167 actions (see the Redshift page)	18 List, 13 Permissions management, 40 Read, 2 Tagging, 94 Write; 0 restricted, 0 conditional	redshift:*
S3	85 of 155	15 List, 55 Read, 2 Tagging, 13 Write; 0 restricted, 0 conditional	s3:CreateBucket, s3:DeleteObject, s3:Get, s3:List, s3:PutAccelerateConfiguration, s3:PutBucketTagging, s3:PutBucketVersioning, s3:PutBucketWebsite, s3:PutLifecycleConfiguration, s3:PutObject, s3:PutReplicationConfiguration, s3:Replicate*
SNS	21 of 40	7 List, 1 Permissions management, 9 Read, 4 Write; 0 restricted, 0 conditional	sns:CreateTopic, sns:DeleteTopic, sns:Get, sns:List, sns:SetTopicAttributes, sns:Subscribe, sns:Unsubscribe

CloudWatch: 69 actions

cloudwatch:DeleteAlarms (Write)
cloudwatch:DescribeAlarmHistory (Read)
cloudwatch:DescribeAlarms (Read)
cloudwatch:DescribeAlarmsForMetric (Read)
cloudwatch:DescribeAnomalyDetectors (Read)
cloudwatch:DescribeInsightRules (Read)
cloudwatch:DisableAlarmActions (Write)
cloudwatch:EnableAlarmActions (Write)
cloudwatch:GetAccessGrant (Read)
cloudwatch:GetAccessProfile (Read)
cloudwatch:GetAgentGraph (Read)
cloudwatch:GetAlarmMuteRule (Read)
cloudwatch:GetAlert (Read)
cloudwatch:GetContextGraph (Read)
cloudwatch:GetDashboard (Read)
cloudwatch:GetDataset (Read)
cloudwatch:GetDomain (Read)
cloudwatch:GetDomainAccessGrantForOrganization (Read)
cloudwatch:GetDomainForOrganization (Read)
cloudwatch:GetIngestionEndpoint (Read)
cloudwatch:GetInsightRuleReport (Read)
cloudwatch:GetIntegration (Read)
cloudwatch:GetIntelligenceConfiguration (Read)
cloudwatch:GetMetricDataQueryDefinition (Read)
cloudwatch:GetMetricStream (Read)
cloudwatch:GetOTelEnrichment (Read)
cloudwatch:GetOmniDashboard (Read)
cloudwatch:GetOmniThread (Read)
cloudwatch:GetPreferences (Read)
cloudwatch:GetProfileRecords (Read)
cloudwatch:GetRecords (Read)
cloudwatch:GetResourceMetricsConfiguration (Read)
cloudwatch:GetService (Read)
cloudwatch:GetServiceData (Read)
cloudwatch:GetServiceLevelObjective (Read)
cloudwatch:GetSpace (Read)
cloudwatch:GetSpaceCredentials (Read)
cloudwatch:GetSpaceCredentialsForOrganization (Read)
cloudwatch:GetSpaceDataAccess (Read)
cloudwatch:GetTelemetryQueryResults (Read)
cloudwatch:GetTopologyDiscoveryStatus (Read)
cloudwatch:GetTopologyMap (Read)
cloudwatch:GetView (Read)
cloudwatch:ListAccessGrants (List)
cloudwatch:ListAccessProfiles (List)
cloudwatch:ListAlarmMuteRules (List)
cloudwatch:ListAlertContributors (List)
cloudwatch:ListAlerts (List)
cloudwatch:ListDashboards (List)
cloudwatch:ListDomainAccessGrantsForOrganization (List)
cloudwatch:ListDomains (List)
cloudwatch:ListEntitiesForMetric (List)
cloudwatch:ListIngestionEndpoints (List)
cloudwatch:ListIntegrations (List)
cloudwatch:ListManagedInsightRules (Read)
cloudwatch:ListMetricDataQueryDefinitions (List)
cloudwatch:ListMetricStreams (List)
cloudwatch:ListOmniDashboards (List)
cloudwatch:ListOmniThreads (List)
cloudwatch:ListServiceLevelObjectives (List)
cloudwatch:ListServices (List)
cloudwatch:ListSpaceAccess (List)
cloudwatch:ListSpaces (List)
cloudwatch:ListSpacesForOrganization (List)
cloudwatch:ListTagsForResource (List)
cloudwatch:ListTelemetryFields (List)
cloudwatch:ListTelemetryQuerySessions (List)
cloudwatch:ListViews (List)
cloudwatch:PutMetricAlarm (Write)

Data Pipeline: 9 actions

datapipeline:ActivatePipeline (Write)
datapipeline:CreatePipeline (Write)
datapipeline:DeletePipeline (Write)
datapipeline:DescribeObjects (Read)
datapipeline:DescribePipelines (Read)
datapipeline:GetPipelineDefinition (Read)
datapipeline:ListPipelines (List)
datapipeline:PutPipelineDefinition (Write)
datapipeline:QueryObjects (Read)

EC2: 7 actions

ec2:DescribeAccountAttributes (List)
ec2:DescribeAddresses (List)
ec2:DescribeAvailabilityZones (List)
ec2:DescribeInternetGateways (List)
ec2:DescribeSecurityGroups (List)
ec2:DescribeSubnets (List)
ec2:DescribeVpcs (List)

IAM: 3 actions

iam:GetRole (Read)
iam:ListRoles (List)
iam:PassRole (Write)

KMS: 1 actions

kms:ListKeys (List)

Lambda: 7 actions

lambda:CreateEventSourceMapping (Write)
lambda:CreateFunction (Write)
lambda:DeleteEventSourceMapping (Write)
lambda:DeleteFunction (Write)
lambda:GetFunctionConfiguration (Read)
lambda:ListEventSourceMappings (List)
lambda:ListFunctions (List)

CloudWatch Logs: 15 actions

logs:CreateDelivery (Write)
logs:CreateExportTask (Write)
logs:CreateImportTask (Write)
logs:CreateLogAnomalyDetector (Write)
logs:CreateLogDelivery (Write)
logs:CreateLogGroup (Write)
logs:CreateLogStream (Write)
logs:CreateLookupTable (Write)
logs:CreateScheduledQuery (Write)
logs:DescribeLogGroups (List)
logs:DescribeLogStreams (List)
logs:FilterLogEvents (Read)
logs:GetLogEvents (Read)
logs:PutLogEvents (Write)
logs:PutMetricFilter (Write)

Performance Insights: 13 actions

pi:CreatePerformanceAnalysisReport (Write)
pi:DeletePerformanceAnalysisReport (Write)
pi:DescribeDimensionKeys (Read)
pi:GetDimensionKeyDetails (Read)
pi:GetPerformanceAnalysisReport (Read)
pi:GetResourceMetadata (Read)
pi:GetResourceMetrics (Read)
pi:ListAvailableResourceDimensions (Read)
pi:ListAvailableResourceMetrics (Read)
pi:ListPerformanceAnalysisReports (List)
pi:ListTagsForResource (List)
pi:TagResource (Tagging)
pi:UntagResource (Tagging)

S3: 85 actions

s3:CreateBucket (Write)
s3:DeleteObjectAnnotation (Write)
s3:DeleteObjectVersionAnnotation (Write)
s3:GetAccelerateConfiguration (Read)
s3:GetAccessGrant (Read)
s3:GetAccessGrantsInstance (Read)
s3:GetAccessGrantsInstanceForPrefix (Read)
s3:GetAccessGrantsInstanceResourcePolicy (Read)
s3:GetAccessGrantsLocation (Read)
s3:GetAccessPoint (Read)
s3:GetAccessPointConfigurationForObjectLambda (Read)
s3:GetAccessPointForObjectLambda (Read)
s3:GetAccessPointPolicy (Read)
s3:GetAccessPointPolicyForObjectLambda (Read)
s3:GetAccessPointPolicyStatus (Read)
s3:GetAccessPointPolicyStatusForObjectLambda (Read)
s3:GetAccountPublicAccessBlock (Read)
s3:GetAnalyticsConfiguration (Read)
s3:GetBucketAbac (Read)
s3:GetBucketAcl (Read)
s3:GetBucketCORS (Read)
s3:GetBucketLocation (Read)
s3:GetBucketLogging (Read)
s3:GetBucketMetadataTableConfiguration (Read)
s3:GetBucketNotification (Read)
s3:GetBucketObjectLockConfiguration (Read)
s3:GetBucketOwnershipControls (Read)
s3:GetBucketPolicy (Read)
s3:GetBucketPolicyStatus (Read)
s3:GetBucketPublicAccessBlock (Read)
s3:GetBucketRequestPayment (Read)
s3:GetBucketTagging (Read)
s3:GetBucketVersioning (Read)
s3:GetBucketWebsite (Read)
s3:GetDataAccess (Read)
s3:GetEncryptionConfiguration (Read)
s3:GetIntelligentTieringConfiguration (Read)
s3:GetInventoryConfiguration (Read)
s3:GetJobTagging (Read)
s3:GetLifecycleConfiguration (Read)
s3:GetMetricsConfiguration (Read)
s3:GetMultiRegionAccessPoint (Read)
s3:GetMultiRegionAccessPointPolicy (Read)
s3:GetMultiRegionAccessPointPolicyStatus (Read)
s3:GetMultiRegionAccessPointRoutes (Read)
s3:GetObjectAnnotation (Read)
s3:GetObjectAttributes (Read)
s3:GetObjectTorrent (Read)
s3:GetObjectVersionAnnotation (Read)
s3:GetObjectVersionAnnotationForReplication (Read)
s3:GetObjectVersionAttributes (Read)
s3:GetObjectVersionForReplication (Read)
s3:GetObjectVersionTorrent (Read)
s3:GetReplicationConfiguration (Read)
s3:GetStorageLensConfiguration (Read)
s3:GetStorageLensConfigurationTagging (Read)
s3:GetStorageLensDashboard (Read)
s3:GetStorageLensGroup (Read)
s3:ListAccessGrants (List)
s3:ListAccessGrantsInstances (List)
s3:ListAccessGrantsLocations (List)
s3:ListAccessPoints (List)
s3:ListAccessPointsForObjectLambda (List)
s3:ListAllMyBuckets (List)
s3:ListBucketMultipartUploads (List)
s3:ListCallerAccessGrants (List)
s3:ListJobs (List)
s3:ListMultiRegionAccessPoints (List)
s3:ListObjectAnnotations (List)
s3:ListObjectVersionAnnotations (List)
s3:ListStorageLensConfigurations (List)
s3:ListStorageLensGroups (List)
s3:ListTagsForResource (List)
s3:PutAccelerateConfiguration (Write)
s3:PutBucketTagging (Tagging)
s3:PutBucketVersioning (Write)
s3:PutBucketWebsite (Write)
s3:PutLifecycleConfiguration (Write)
s3:PutObjectAnnotation (Write)
s3:PutObjectVersionAnnotation (Write)
s3:PutReplicationConfiguration (Write)
s3:ReplicateDelete (Write)
s3:ReplicateObject (Write)
s3:ReplicateObjectAnnotation (Write)
s3:ReplicateTags (Tagging)

SNS: 21 actions

sns:CreateTopic (Write)
sns:DeleteTopic (Write)
sns:GetDataProtectionPolicy (Read)
sns:GetEndpointAttributes (Read)
sns:GetPlatformApplicationAttributes (Read)
sns:GetSMSAttributes (Read)
sns:GetSMSSandboxAccountStatus (Read)
sns:GetSubscriptionAttributes (Read)
sns:GetTopicAttributes (Read)
sns:ListEndpointsByPlatformApplication (List)
sns:ListOriginationNumbers (List)
sns:ListPhoneNumbersOptedOut (Read)
sns:ListPlatformApplications (List)
sns:ListSMSSandboxPhoneNumbers (List)
sns:ListSubscriptions (List)
sns:ListSubscriptionsByTopic (List)
sns:ListTagsForResource (Read)
sns:ListTopics (List)
sns:SetTopicAttributes (Permissions management)
sns:Subscribe (Write)
sns:Unsubscribe (Write)

Data-plane actions (45)

By access level: 4 List, 2 Permissions management, 20 Read, 4 Tagging, 15 Write.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudWatch	4 of 5	1 List, 3 Read; 0 restricted, 0 conditional	cloudwatch:Get, cloudwatch:List
DynamoDB	All 17 actions (see the DynamoDB page)	9 Read, 8 Write; 0 restricted, 0 conditional	dynamodb:*
S3	24 of 25	3 List, 2 Permissions management, 8 Read, 4 Tagging, 7 Write; 0 restricted, 0 conditional	s3:AbortMultipartUpload, s3:DeleteObject, s3:Get, s3:List, s3:PutObject, s3:RestoreObject

CloudWatch: 4 actions

cloudwatch:GetMetricData (Read)
cloudwatch:GetMetricStatistics (Read)
cloudwatch:GetMetricWidgetImage (Read)
cloudwatch:ListMetrics (List)

S3: 24 actions

s3:AbortMultipartUpload (Write)
s3:DeleteObject (Write)
s3:DeleteObjectTagging (Tagging)
s3:DeleteObjectVersion (Write)
s3:DeleteObjectVersionTagging (Tagging)
s3:GetObject (Read)
s3:GetObjectAcl (Read)
s3:GetObjectLegalHold (Read)
s3:GetObjectRetention (Read)
s3:GetObjectTagging (Read)
s3:GetObjectVersion (Read)
s3:GetObjectVersionAcl (Read)
s3:GetObjectVersionTagging (Read)
s3:ListBucket (List)
s3:ListBucketVersions (List)
s3:ListMultipartUploadParts (List)
s3:PutObject (Write)
s3:PutObjectAcl (Permissions management)
s3:PutObjectLegalHold (Write)
s3:PutObjectRetention (Write)
s3:PutObjectTagging (Tagging)
s3:PutObjectVersionAcl (Permissions management)
s3:PutObjectVersionTagging (Tagging)
s3:RestoreObject (Write)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants at least 80% of the write and permissions-management actions of: dynamodb (45 of 45), elasticache (54 of 54), rds (119 of 119), redshift (107 of 107).
Grants data-plane write actions on a data store on all resources without conditions.
Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).
30 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them.

Guidance

Practical scope

AWS says the policy grants permissions to create, configure and maintain databases, with access to AWS database services such as Amazon DynamoDB, Amazon RDS and Amazon Redshift. The document allows dynamodb:*, rds:*, redshift:* and elasticache:* in full on Resource "*", plus Amazon S3 object actions on all resources, including s3:DeleteObject*, s3:PutObject*, s3:Get* and s3:List*. It allows iam:PassRole only on roles named rds-monitoring-role, rdbms-lambda-access, lambda_exec_role, lambda-dynamodb-*, lambda-vpc-execution-role, DataPipelineDefaultRole and DataPipelineDefaultResourceRole.

Use cases

The Database administrator job function: a user who sets up, configures and maintains databases in the AWS Cloud.
Passing a role to a service through the named service roles, for example rds-monitoring-role to monitor RDS databases and lambda-dynamodb-* to let Lambda functions act as triggers for DynamoDB tables.

Prerequisites

If your users need the optional service roles, you must create a role that follows the naming convention in the policy and grant permissions to that role.

Best practices

AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions.
The job function policies include filters that limit the names of valid roles that can be passed, which helps avoid granting unnecessary permissions.

Security considerations

Most actions apply to Resource "*", including full access to Amazon DynamoDB, Amazon RDS, Amazon Redshift and ElastiCache (dynamodb:*, rds:*, redshift:*, elasticache:*) and delete actions such as s3:DeleteObject*, lambda:DeleteFunction, sns:DeleteTopic and datapipeline:DeletePipeline.
The policy grants iam:PassRole, which allows a user to pass a role to an AWS service. In this policy it is limited to the roles named in the IAM User Guide table.
You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS says you can attach job function policies to any IAM identity. It fits where one user needs to set up and maintain several AWS database services.

Same service

Same domain

Frequently asked questions

When should I attach DatabaseAdministrator?: Attach it to a user who sets up, configures and maintains databases in the AWS Cloud. It is the Database administrator job function, which AWS designed to align with a common job function in the IT industry.
What does DatabaseAdministrator grant?: It grants permissions to create, configure and maintain databases, including access to Amazon DynamoDB, Amazon RDS and Amazon Redshift. The document allows dynamodb:*, rds:*, redshift:* and elasticache:* in full, plus a set of Amazon S3 object actions on all resources.
What are the security risks of DatabaseAdministrator?: Most actions apply to all resources and include full access to several database services and delete actions such as s3:DeleteObject* and lambda:DeleteFunction. It allows iam:PassRole, limited to the named roles. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:DeleteAlarms",
        "cloudwatch:Describe*",
        "cloudwatch:DisableAlarmActions",
        "cloudwatch:EnableAlarmActions",
        "cloudwatch:Get*",
        "cloudwatch:List*",
        "cloudwatch:PutMetricAlarm",
        "datapipeline:ActivatePipeline",
        "datapipeline:CreatePipeline",
        "datapipeline:DeletePipeline",
        "datapipeline:DescribeObjects",
        "datapipeline:DescribePipelines",
        "datapipeline:GetPipelineDefinition",
        "datapipeline:ListPipelines",
        "datapipeline:PutPipelineDefinition",
        "datapipeline:QueryObjects",
        "dynamodb:*",
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeAddresses",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "elasticache:*",
        "iam:ListRoles",
        "iam:GetRole",
        "kms:ListKeys",
        "lambda:CreateEventSourceMapping",
        "lambda:CreateFunction",
        "lambda:DeleteEventSourceMapping",
        "lambda:DeleteFunction",
        "lambda:GetFunctionConfiguration",
        "lambda:ListEventSourceMappings",
        "lambda:ListFunctions",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:FilterLogEvents",
        "logs:GetLogEvents",
        "logs:Create*",
        "logs:PutLogEvents",
        "logs:PutMetricFilter",
        "pi:CreatePerformanceAnalysisReport",
        "pi:DeletePerformanceAnalysisReport",
        "pi:DescribeDimensionKeys",
        "pi:GetDimensionKeyDetails",
        "pi:GetPerformanceAnalysisReport",
        "pi:GetResourceMetadata",
        "pi:GetResourceMetrics",
        "pi:ListAvailableResourceDimensions",
        "pi:ListAvailableResourceMetrics",
        "pi:ListPerformanceAnalysisReports",
        "pi:ListTagsForResource",
        "pi:TagResource",
        "pi:UntagResource",
        "rds:*",
        "redshift:*",
        "s3:CreateBucket",
        "sns:CreateTopic",
        "sns:DeleteTopic",
        "sns:Get*",
        "sns:List*",
        "sns:SetTopicAttributes",
        "sns:Subscribe",
        "sns:Unsubscribe"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject*",
        "s3:Get*",
        "s3:List*",
        "s3:PutAccelerateConfiguration",
        "s3:PutBucketTagging",
        "s3:PutBucketVersioning",
        "s3:PutBucketWebsite",
        "s3:PutLifecycleConfiguration",
        "s3:PutReplicationConfiguration",
        "s3:PutObject*",
        "s3:Replicate*",
        "s3:RestoreObject"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/rds-monitoring-role",
        "arn:aws:iam::*:role/rdbms-lambda-access",
        "arn:aws:iam::*:role/lambda_exec_role",
        "arn:aws:iam::*:role/lambda-dynamodb-*",
        "arn:aws:iam::*:role/lambda-vpc-execution-role",
        "arn:aws:iam::*:role/DataPipelineDefaultRole",
        "arn:aws:iam::*:role/DataPipelineDefaultResourceRole"
      ]
    }
  ]
}

Version history

Current version v5, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/job-function/DatabaseAdministrator
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/job-function/DatabaseAdministrator
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/job-function/DatabaseAdministrator

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/job-function/DatabaseAdministrator

Terraform

resource "aws_iam_role_policy_attachment" "job_function_databaseadministrator" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/job-function/DatabaseAdministrator"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("job-function/DatabaseAdministrator"),
);

Sources

DatabaseAdministrator (AWS Managed Policy Reference Guide) (retrieved 2026-11-12; supports summary, practicalScope, securityConsiderations, assignmentGuidance, faqs)
AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports practicalScope, useCases, prerequisites, bestPractices, securityConsiderations, assignmentGuidance, faqs)
Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)