docs: update require permissions

As a result of the option to rotate RDS secrets automatically via AWS, we should documenent the required permissions.
cloudfoundry · Jan 13, 2025 · b8b82c5 · b8b82c5
1 parent e281688
commit b8b82c5
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/docs/installation.md b/docs/installation.md
@@ -78,6 +78,11 @@ The AWS account represented by the access key needs the following permission pol
                 "iam:ListPolicies",
                 "iam:ListUserPolicies",
                 "iam:PutUserPolicy",
+                "kms:GenerateDataKey",
+                "kms:Encrypt",
+                "kms:DescribeKey",
+                "kms:Decrypt",
+                "kms:CreateGrant",
                 "logs:CreateLogDelivery",
                 "logs:CreateLogGroup",
                 "logs:DescribeResourcePolicies",
@@ -124,6 +129,15 @@ The AWS account represented by the access key needs the following permission pol
                 "rds:ModifyDBInstance",
                 "rds:ModifyDBParameterGroup",
                 "rds:DescribeDBEngineVersions",
+                "secretsmanager:CancelRotateSecret",
+                "secretsmanager:CreateSecret",
+                "secretsmanager:DeleteSecret",
+                "secretsmanager:DescribeSecret",
+                "secretsmanager:GetSecretValue",
+                "secretsmanager:PutSecretValue",
+                "secretsmanager:RotateSecret",
+                "secretsmanager:TagResource",
+                "secretsmanager:UpdateSecret",
                 "s3:BypassGovernanceRetention",
                 "s3:BypassGovernanceRetention",
                 "s3:CreateAccessPoint",