title: How to give grained IAM control for AWS Aurora?
body: <p>I want to give a least privilege IAM policy to control creation and deletion of AWS Aurora instances. Rights for DB Instances working fine, but DB Cluster objects can not be deleted:</p>
  
  <pre><code>User xxxxxxx is not authorized to perform: rds:DeleteDBCluster
  </code></pre>
  
  <p>Here is what rights I want:</p>
  
  <pre><code>{
    "Sid": "313",
    "Effect": "Allow",
    "Action": [
      "rds:ModifyDBCluster",
      "rds:DeleteDBCluster"
    ],
    "Resource": "arn:aws:rds:eu-west-1:123456789101:cluster:*",
    "Condition": {
      "StringEquals": {
        "rds:cluster-tag/author": "qa"
      }
    }
  }
  </code></pre>
  
  <p>But as far as I tested only this works:</p>
  
  <pre><code>{
    "Sid": "313",
    "Effect": "Allow",
    "Action": [
      "rds:ModifyDBCluster",
      "rds:DeleteDBCluster"
    ],
    "Resource": "*"
  }
  </code></pre>