Articles → AWS → Tag Based Policy In AWS

Tag Based Policy In AWS

In this article, we will implement a tag-based policy in AWS.

Steps

For implementing the tag-based policy in AWS, we will work on the following steps: -

Create a policy
Create a user
Create 2 DB instances
Apply tags on the databases
Test the policy

Let us start.

Create A Policy

First, create a policy. This is the JSON of the policy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances",
                "rds:DescribeDBClusters",
                "rds:DescribeGlobalClusters"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "rds:RebootDBInstance",
                "rds:StartDBInstance",
                "rds:StopDBInstance"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "rds:db-tag/Environment": "Production"
                }
            }
        }
    ]
}

In the above JSON code, we are allowing reboot, start, and stop database actions if the tag on the database is Environment:Production.

Picture showing the policy created in AWS console

Click to Enlarge

Create A User

The second step is to create a user and assign the policy created in the previous step to the user.

Picture showing a user created in AWS console

Click to Enlarge

Create 2 DB Instances

The third step is to create 2 database instances.

Picture showing the 2 DB instances created in AWS RDS

Click to Enlarge

Apply Tags On The Databases

Apply tags on both databases.

Picture showing the tag added in database-1

Click to Enlarge

Picture showing the tag added in database-2

Click to Enlarge

Test The Policy

To test the policy, log in with the test user in the AWS console. In the RDS, you will see 2 databases.

Try to reboot the second database, you will get the following message,

Picture showing the error message when user tries to reboot database-2

Click to Enlarge

Now try to reboot the first database. You will be able to reboot it.

Picture showing the database-1 reboot in progress

Click to Enlarge

Posted By -	Karan Gupta

Posted On -	Tuesday, May 17, 2022

Query/Feedback

Your Email Id		**

Subject		*

Query/Feedback	Characters remaining 250	**