Creating the KMS key Creating the database secrets Creating the IAM role Updating the KMS key Adding the IAM role permission policies

Setting up database authentication and resource access manually

The manual process for setting up database authentication and resource access has the following steps:

Creating the customer-managed AWS KMS key
Adding the IAM role permission policies
Creating the database secrets
Creating the IAM role
Updating the customer-managed AWS KMS key

This process is optional, and performs the same tasks as in Setting up database authentication and resource access using a script. We recommend using the script.

Creating the customer-managed AWS KMS key

Follow the procedures in Creating symmetric encryption keys to create a customer-managed KMS key. You can also use an existing key if it meets these requirements.

To create a customer-managed KMS key

Sign in to the AWS Management Console and open the AWS KMS console at https://console.aws.amazon.com/kms.
Navigate to the Customer managed keys page.
Choose Create key.
On the Configure key page:
1. For Key type, select Symmetric.
2. For Key usage, select Encrypt and decrypt.
3. Choose Next.
On the Add labels page, enter an Alias such as limitless, then choose Next.
On the Define key administrative permissions page, make sure that the Allow key administrators to delete this key check box is selected, then choose Next.
On the Define key usage permissions page, choose Next.
On the Review page, choose Finish.

You update the key policy later.

Record the Amazon Resource Names (ARN) of the KMS key to use in Adding the IAM role permission policies.

For information on using the AWS CLI to create the customer-managed KMS key, see create-key and create-alias.

Creating the database secrets

To allow the data loading utility to access the source and destination database tables, you create two secrets in AWS Secrets Manager: one for the source database and one for the destination database. These secrets store the usernames and passwords for accessing the source and destination databases.

Follow the procedures in Create an AWS Secrets Manager secret to create the key-value pair secrets.

To create the database secrets

Open the Secrets Manager console at https://console.aws.amazon.com/secretsmanager/.
Choose Store a new secret.
On the Choose secret type page:
1. For Secret type, select Other type of secret.
2. For Key/value pairs, choose the Plaintext tab.
3. Enter the following JSON code, where sourcedbreader and sourcedbpassword are the credentials for the source database user from Create the source database credentials.
```
{
    "username":"sourcedbreader",
    "password":"sourcedbpassword"
}
```
4. For Encryption key, choose the KMS key that you created in Creating the customer-managed AWS KMS key, for example limitless.
5. Choose Next.
On the Configure secret page, enter a Secret name, such as source_DB_secret, then choose Next.
On the Configure rotation - optional page, choose Next.
On the Review page, choose Store.
Repeat the procedure for the destination database secret:
1. Enter the following JSON code, where destinationdbwriter and destinationdbpassword are the credentials for the destination database user from Create the destination database credentials.
```
{
    "username":"destinationdbwriter",
    "password":"destinationdbpassword"
}
```
2. Enter a Secret name, such as destination_DB_secret.

Record the ARNs of the secrets to use in Adding the IAM role permission policies.

Creating the IAM role

Data loading requires you to provide access to AWS resources. To provide access, you create the aurora-data-loader IAM role by following the procedures in Creating a role to delegate permissions to an IAM user.

To create the IAM role

Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
Navigate to the Roles page.
Choose Create role.

On the Select trusted entity page:

For Trusted entity type, select Custom trust policy.

Enter the following JSON code for the custom trust policy:


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "rds.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Choose Next.

On the Add permissions page, choose Next.
On the Name, review, and create page:
1. For Role name, enter aurora-data-loader or another name that you prefer.
2. Choose Add tag, and enter the following tag:
  - Key: assumer
  - Value: aurora_limitless_table_data_load
  Important
  The Aurora PostgreSQL Limitless Database can only assume an IAM role that has this tag.
3. Choose Create role.

Updating the customer-managed AWS KMS key

Follow the procedures in Changing a key policy to add the IAM role aurora-data-loader to the default key policy.

To add the IAM role to the key policy

Sign in to the AWS Management Console and open the AWS KMS console at https://console.aws.amazon.com/kms.
Navigate to the Customer managed keys page.
Choose the KMS key that you created in Creating the customer-managed AWS KMS key, for example limitless.
On the Key policy tab, for Key users, choose Add.
In the Add key users window, select the name of the IAM role that you created in Creating the IAM role, for example aurora-data-loader.
Choose Add.

Adding the IAM role permission policies

You must add permission policies to the IAM role that you created. This allows the Aurora PostgreSQL Limitless Database data loading utility to access related AWS resources for building network connections and retrieving the source and destination DB credential secrets.

For more information, see Modifying a role.

To add the permission policies

Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
Navigate to the Roles page.
Choose the IAM role that you created in Creating the IAM role, for example aurora-data-loader.
On the Permissions tab, for Permissions policies choose Add permissions, then Create inline policy.
On the Specify permissions page, choose the JSON editor.

Copy and paste the following template into the JSON editor, replacing the placeholders with the ARNs for your database secrets and KMS key.


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Ec2Permission",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeNetworkInterfaces",
                "ec2:CreateNetworkInterface",
                "ec2:DeleteNetworkInterface",
                "ec2:CreateNetworkInterfacePermission",
                "ec2:DeleteNetworkInterfacePermission",
                "ec2:DescribeNetworkInterfacePermissions",
                "ec2:ModifyNetworkInterfaceAttribute",
                "ec2:DescribeNetworkInterfaceAttribute",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeRegions",
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeNetworkAcls"
            ],
            "Resource": "*"
        },
        {
            "Sid": "SecretsManagerPermissions",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret"
            ],
            "Resource": [
                "arn:aws:secretsmanager:us-east-1:123456789012:secret:source_DB_secret-ABC123",
                "arn:aws:secretsmanager:us-east-1:123456789012:secret:destination_DB_secret-456DEF"
            ]
        },        {
            "Sid": "KmsPermissions",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:us-east-1:123456789012:key/aa11bb22-####-####-####-fedcba123456"
        },
        {
            "Sid": "RdsPermissions",
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBClusters",
                "rds:DescribeDBInstances"
            ],
            "Resource": "*"
        }
    ]
}

Check for errors and correct them.
Choose Next.
On the Review and create page, enter a Policy name such as data_loading_policy, then choose Create policy.

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Setting up access using a script

Loading data into Limitless Database