Cannot find permissions for: rds:DescribeDBSnapshots, rds:CopyDBSnapshot, rds:DeleteDBSnapshot when creating Role.

When creating an IAM role for a Lambda function to copy RDS snapshots, you won't find individual permissions like rds:DescribeDBSnapshots directly in the visual permission selector. Instead, you need to use AWS managed policies or create a custom policy.

Here's how to add these permissions:

1. In the "Create role" workflow, after selecting Lambda as the trusted entity, you have a few options:

• Search for and add the "AmazonRDSFullAccess" managed policy (this grants more permissions than needed)
• Or click on "Create policy" to define a custom policy with just the permissions you need

2. If creating a custom policy, choose the JSON editor and add a policy like:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"rds:DescribeDBSnapshots",
"rds:CopyDBSnapshot",
"rds:DeleteDBSnapshot"
],
"Resource": "*"
}
]
}

3. For cross-region snapshot copying, you'll also need the rds:CrossRegionCommunication permission, which is included in the service-linked IAM role that RDS uses.

After creating the custom policy, you can attach it to your Lambda role. This approach gives your Lambda function the precise permissions needed to manage RDS snapshots without granting excessive access.
Sources
Copying a DB snapshot for Amazon RDS - Amazon Relational Database Service
AWSSupport-ShareRDSSnapshot - AWS Systems Manager Automation runbook reference