IAM user and permissions

Create a dedicated IAM user in each AWS account that DCT will manage. DCT uses these credentials for all discovery and operational API calls.

AWS managed identities are not supported. DCT cannot use IAM instance roles, EKS IRSA, or ECS task roles for authentication. A static IAM access key (access key ID and secret access key) must be generated and provided. A single access key pair can be reused across multiple AWS regions — create one key per account, not per region.

The IAM user must, at minimum, have the permissions listed below. Follow the principle of least privilege. Create a dedicated IAM user for DCT and avoid sharing credentials with other applications or services.

Discovery and read permissions

  • rds:DescribeDBInstances

  • rds:DescribeDBSnapshots

  • rds:DescribeDBInstanceAutomatedBackups

  • rds:DescribeDBParameterGroups

  • rds:DescribeDBSubnetGroups

  • rds:DescribeDBEngineVersions

  • rds:DescribeOptionGroups

  • rds:ListTagsForResource

  • rds:DescribeDBSnapshotAttributes

Provisioning

  • rds:CreateDBInstance

  • rds:RestoreDBInstanceFromDBSnapshot

  • rds:RestoreDBInstanceToPointInTime

  • rds:CreateDBInstanceReadReplica

Management

  • rds:ModifyDBInstance

  • rds:RebootDBInstance

  • rds:StopDBInstance

  • rds:StartDBInstance

  • rds:AddTagsToResource

  • rds:RemoveTagsFromResource

Snapshots

  • rds:CreateDBSnapshot

  • rds:CopyDBSnapshot

  • rds:DeleteDBSnapshot

  • rds:ModifyDBSnapshot

  • rds:ModifyDBSnapshotAttribute

Automated backups

  • rds:DeleteDBInstanceAutomatedBackup

Deprovisioning

  • rds:DeleteDBInstance

VPC

  • ec2:DescribeVpcs

  • ec2:DescribeSubnets

  • ec2:DescribeSecurityGroups

  • ec2:DescribeAvailabilityZones

KMS

  • kms:DescribeKey

  • kms:CreateGrant

  • kms:GenerateDataKey

  • kms:Decrypt

  • kms:ReEncryptFrom

  • kms:ReEncryptTo

  • kms:ListKeys

  • kms:ListAliases

Regional constraint

Each Cloud Account in DCT is scoped to a single AWS region. If you manage databases in multiple regions, create a separate Cloud Account for each region. IAM permissions should be scoped to the relevant region wherever possible.

Database credentials

CD4P does not access AWS RDS databases directly for standard operations such as provision, refresh, and snapshot — these are performed entirely through AWS APIs. Database credentials are only required if you are running profiling or masking workflows via Continuous Compliance. In that case, a standard Continuous Compliance connector must be created with a database admin username and password with sufficient privileges on the target RDS instances.

Architecture

The recommended architecture for AWS RDS deployments:

  • Production Account: Contains the source RDS instance (Root Source). DCT discovers this account and orchestrates the golden copy provisioning from it.

  • Neutral Zone: DCT is deployed here. Has HTTPS API access to both production and non-production AWS accounts.

  • Production Zone: Continuous Compliance engine is deployed here with JDBC access to the production RDS instance.

  • Non-Production Account: Contains provisioned development and testing databases. DCT provisions these from shared masked bookmarks.

All resources — production source, golden copy, and non-production databases — must be in the same AWS region. DCT orchestrates cross-account operations within that region using account-specific IAM credentials.

Last updated
Oct 8, 2026