RDS CreateDBInstance: can dependent AddTagsToResource permission be restricted to creation only?

Question

I am reviewing least-privilege permissions for a CloudFormation execution role that creates an AWS::RDS::DBInstance with six required application ownership tags.

The RDS service authorization reference lists rds:AddTagsToResource as a dependent permission of rds:CreateDBInstance.

A read-only DescribeType capture for AWS::RDS::DBInstance in eu-central-1 on 2026-09-11 also showed:

* tagging.tagOnCreate = true
* tagging.cloudFormationSystemTags = true
* rds:AddTagsToResource in handlers.create.permissions

These describe the provider's declared capabilities, but do not establish the actual IAM condition context during creation.

The candidate policy design is:

* Allow CreateDBInstance on an exact DB ARN, subject to required aws:RequestTag conditions and an aws:TagKeys allowlist.
* Separately allow AddTagsToResource on that ARN only when all six ownership tags already match through aws:ResourceTag conditions, the requested tags match, rds:TagsFromRequest is true, and aws:TagKeys is restricted to the six application keys.

The goal is to allow initial tagged creation while preventing the same principal from applying ownership tags to an existing untagged or differently tagged DB instance. This is a pre-deployment review; no database creation test has been performed for this investigation.

Could someone clarify:

1. During the dependent AddTagsToResource authorization check for CreateDBInstance with inline Tags, what values are available for aws:ResourceTag, aws:RequestTag, aws:TagKeys, and rds:TagsFromRequest? Specifically, are the proposed tags available as ResourceTag values, or are those keys absent because the DB instance does not yet exist?

2. If requiring existing ResourceTag values blocks initial creation, is there a documented condition that permits this dependent creation-time check while denying a standalone AddTagsToResource request against an existing unowned DB instance? I am looking for a creation-only discriminator, beyond the exact ARN and requested tag values. If none exists, what supported alternative control would enforce this separation?

3. When CloudFormation supplies its system-generated aws:cloudformation:* tags, are those keys included in aws:TagKeys during CreateDBInstance and its dependent tagging authorization? Would an allowlist containing only the application tag keys reject that path?

Please distinguish a dependent authorization check from a separate API call: absence of a separate AddTagsToResource CloudTrail event would not, by itself, establish the authorization context.

References:

* [RDS service authorization reference](https://docs.aws.amazon.com/service-authorization/latest/reference/list_rds.html)
* [CreateDBInstance API](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html)
* [CloudFormation resource type schema](https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/resource-type-schema.html)

Documentation or a service-specific explanation of the condition-key behavior would be especially helpful.

Florian Turnwald · Answer

To my understanding, based on AWS IAM evaluation logic and documented Amazon RDS capabilities, here are the answers to your constraints:

**1. Context during Creation**
During the dependent `rds:AddTagsToResource` check at creation time, the resource does not yet exist. Therefore, `aws:ResourceTag` evaluates to null. If your IAM policy requires specific `aws:ResourceTag` values to allow `rds:AddTagsToResource`, the `CreateDBInstance` request will be denied. `aws:RequestTag` and `aws:TagKeys` will contain the tags passed in the initial creation request.

**2. Creation-Only Discriminator**
RDS does not support a creation-only tag discriminator. Unlike Amazon EC2, which provides the `ec2:CreateAction` condition key to strictly isolate tag-on-create authorizations, RDS lacks an equivalent context key. You cannot natively allow `rds:AddTagsToResource` solely during creation using IAM conditions.
*Alternative Control:* Enforce the exact ARN and `aws:RequestTag` rules for creation in IAM, but rely on AWS Config (detective) or SCPs (preventative) to prevent unauthorized tag modifications post-creation.

**3. CloudFormation System Tags**
CloudFormation automatically injects its system tags (`aws:cloudformation:stack-id`, etc.) into the API request. These keys are evaluated in the `aws:TagKeys` condition. If you use `ForAllValues:StringEquals` on `aws:TagKeys` and restrict it exclusively to your six application keys, the `CreateDBInstance` request will fail. You must explicitly allow the `aws:cloudformation:*` keys in your `aws:TagKeys` allowlist.

### Verified Official AWS Documentation Links

* [AWS IAM User Guide: Controlling Access Using Tags](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html)
* [AWS Service Authorization Reference for Amazon RDS](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrds.html)
* [Amazon RDS User Guide: Tagging Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html)
* [AWS Management & Governance Blog: Implement Tagging Strategies & SCP Controls](https://aws.amazon.com/blogs/mt/implement-aws-resource-tagging-strategy-using-aws-tag-policies-and-service-control-policies-scps/)

RDS CreateDBInstance: can dependent AddTagsToResource permission be restricted to creation only?

Verified Official AWS Documentation Links

Add your answer

Relevant content