How do I modify permissions for multiple Amazon RDS snapshots?

Short description

To modify permissions for multiple Amazon RDS snapshots, use the AWSSupport-ModifyRDSSnapshotPermission runbook. This runbook allows you to make your RDS snapshots public or private and share them with other AWS accounts.

Note: You can't use the runbook to share encrypted snapshots that have a default AWS Key Management System (AWS KMS).

Resolution

Prerequisites

Before you run the automation, make sure that your AWS Identity and Access Management (IAM) user or the role has required permissions. For more information, see AWSSupport-ModifyRDSSnapshotPermission.

Note: To share an encrypted snapshot with another account, share the AWS KMS key with the destination account.

Run the Systems Manager automation runbook

Complete the following steps:

1. Open the AWS Systems Manager console.
2. In the navigation pane, choose Documents.
3. In the search bar, enter AWSSupport-ModifyRDSSnapshotPermission (Owner: Amazon).
4. Select the AWSSupport-ModifyRDSSnapshotPermission document.
5. Choose Execute automation.
6. For the input parameters, enter the following:
   SnapshotIds: The IDs of Amazon RDS snapshots that you want to share or modify the permissions of.
   Private: Choose No to share the snapshot with specific account IDs.
   AutomationAssumeRole (optional): The Amazon Resource Name (ARN) of the IAM role that allows Systems Manager Automation to perform the actions on your behalf. If you don't specify a role, then Systems Manager Automation uses the permissions of the user that runs the document.
   AccountIds (optional): The list of account IDs for accounts that you want to share the snapshot with.
   AccountPermissionOperation (optional): Account-level permissions. Choose add, remove or none.
7. Choose Execute.
8. Review the Outputs section for detailed results:
   MakePrivate.Results: If you chose Yes for Private, then this field includes the SnapshotID and result of the operation.
   SharedOtherAccounts.Result: If you chose AccountPermissionOperation, then this field includes the result of the operation.
   MakePrivate.Commands: This field includes the command that the runbook used to modify the permissions of the RDS snapshot.
   ValidateSnapshots.EncryptedSnapshots: This field lists the encrypted snapshots that are passed as inputs to share with other accounts.

View the snapshots with updated permissions

Complete the following steps:

1. Open the Amazon RDS console.
2. In the navigation pane, choose Snapshots.
3. Choose your RDS snapshots.

Related information

Run an automation

Setting up Automation

Systems Manager Automation runbook reference