Repository: CloudSnorkel/cdk-rds-sanitized-snapshots (language: python)

Issue:
Create Temporary Database fails: not authorized to perform: rds:AddTagsToResource on resource
If using an instance, not a cluster, the Create Temporary Database step will fail with an error similar to

```
SnapshotterDirectorRoleXXXX-XXXX/XXXX is not authorized to perform: rds:AddTagsToResource on 
resource: arn:aws:rds:<region>:<account>:db:sanitize-XXXX because no identity-based policy allows 
the rds:AddTagsToResource action (Service: Rds, Status Code: 403)
```

The reason for this is when creating the `SnapshotterDirectorRoleDefaultPolicy` it only adds the `cluster:sanitize-*` resource pattern. When not in cluster mode, it needs to add the pattern `db:sanitize-*`




Discussion / hints:

Fix patch:
diff --git a/src/index.ts b/src/index.ts
index df76efc..dc72f8d 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -284,7 +284,7 @@ export class RdsSanitizedSnapshotter extends Construct {
     // needed for creating a snapshot with tags
     this.snapshotter.addToRolePolicy(new iam.PolicyStatement({
       actions: ['rds:AddTagsToResource'],
-      resources: [this.tempSnapshotArn, this.targetSnapshotArn, this.tempDbClusterArn],
+      resources: [this.tempSnapshotArn, this.targetSnapshotArn, this.tempDbClusterArn, this.tempDbInstanceArn],
     }));
 
     // key permissions


Test patch:
diff --git a/test/default.integ.snapshot/RDS-Sanitized-Snapshotter-SFN.assets.json b/test/default.integ.snapshot/RDS-Sanitized-Snapshotter-SFN.assets.json
index 0640972..8ad4840 100644
--- a/test/default.integ.snapshot/RDS-Sanitized-Snapshotter-SFN.assets.json
+++ b/test/default.integ.snapshot/RDS-Sanitized-Snapshotter-SFN.assets.json
@@ -40,7 +40,7 @@
         }
       }
     },
-    "77c4d732ada8ebcce7500544251e21c9286d5c95eef46636cafee5a21016e225": {
+    "4d342d6a3f6400ba76ff90f4cd6140b4d7b6f7a8a8c14189a2b75f634544caac": {
       "source": {
         "path": "RDS-Sanitized-Snapshotter-SFN.template.json",
         "packaging": "file"
@@ -48,7 +48,7 @@
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "77c4d732ada8ebcce7500544251e21c9286d5c95eef46636cafee5a21016e225.json",
+          "objectKey": "4d342d6a3f6400ba76ff90f4cd6140b4d7b6f7a8a8c14189a2b75f634544caac.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
diff --git a/test/default.integ.snapshot/RDS-Sanitized-Snapshotter-SFN.template.json b/test/default.integ.snapshot/RDS-Sanitized-Snapshotter-SFN.template.json
index 0dc92a6..4bba36e 100644
--- a/test/default.integ.snapshot/RDS-Sanitized-Snapshotter-SFN.template.json
+++ b/test/default.integ.snapshot/RDS-Sanitized-Snapshotter-SFN.template.json
@@ -1337,6 +1337,26 @@
            ":cluster:sanitize-*"
           ]
          ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           "arn:",
+           {
+            "Ref": "AWS::Partition"
+           },
+           ":rds:",
+           {
+            "Ref": "AWS::Region"
+           },
+           ":",
+           {
+            "Ref": "AWS::AccountId"
+           },
+           ":db:sanitize-*"
+          ]
+         ]
         }
        ]
       }
@@ -3016,6 +3036,26 @@
            ":cluster:sanitize-*"
           ]
          ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           "arn:",
+           {
+            "Ref": "AWS::Partition"
+           },
+           ":rds:",
+           {
+            "Ref": "AWS::Region"
+           },
+           ":",
+           {
+            "Ref": "AWS::AccountId"
+           },
+           ":db:sanitize-*"
+          ]
+         ]
         }
        ]
       }
@@ -4549,6 +4589,26 @@
            ":cluster:sanitize-*"
           ]
          ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           "arn:",
+           {
+            "Ref": "AWS::Partition"
+           },
+           ":rds:",
+           {
+            "Ref": "AWS::Region"
+           },
+           ":",
+           {
+            "Ref": "AWS::AccountId"
+           },
+           ":db:sanitize-*"
+          ]
+         ]
         }
        ]
       },
@@ -6216,6 +6276,26 @@
            ":cluster:sanitize-*"
           ]
          ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           "arn:",
+           {
+            "Ref": "AWS::Partition"
+           },
+           ":rds:",
+           {
+            "Ref": "AWS::Region"
+           },
+           ":",
+           {
+            "Ref": "AWS::AccountId"
+           },
+           ":db:sanitize-*"
+          ]
+         ]
         }
        ]
       },