Search code examples
amazon-neptune

How to limit access to the read only endpoint in Amazon Neptune?

I'd like to create a role that can access only the read-only endpoint.

Constructing the resource arn as described here will allow access to both read and write endpoints.

I tried setting the resource id of the READER instance in the arn in these ways:

  • arn:aws:neptune-db:region:account-id:reader-instance-resource-id/*
  • arn:aws:neptune-db:region:account-id:cluster-resource-id/reader-instance-resource-id
  • arn:aws:neptune-db:region:account-id:cluster-resource-id/reader-instance-resource-id/*

But none of these work. Is there a way to give a role the read access only?

Solution

  • The roles and policies that Amazon Neptune currently supports are listed here. Currently, the NeptuneReadOnlyAccess managed policy applies only to the control plane. It allows you to read but not alter configurations. That policy does not apply to the data plane (running queries).

    It is possible that a future Amazon Neptune update may add additional access control policies.

    For right now, you will need to manage access to instances and endpoints as part of your application architecture.