diff --git a/CHANGELOG.md b/CHANGELOG.md
index 39b74a3..aab1d5d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -94,7 +94,6 @@
    - updated policies/sc-developer
      - add kms:UpdateKeyDescription
 
-<<<<<<< HEAD
 * 1.8.0 -- 2026-05-27
   - group-assignment
     - add validation that the provided account_names actuall exist within the organization
@@ -102,3 +101,7 @@
 * 1.8.1 -- 2026-05-28
   - updated policies/sc-servicecatalog-t1,-t2
     - deny update to provisioned products and properties of provisioned products
+
+* 1.9.0 -- 2026-06-04
+  - created policies
+    - policies/sc-dbuser
diff --git a/policies/sc-dbuser/.terraform.lock.hcl b/policies/sc-dbuser/.terraform.lock.hcl
deleted file mode 100644
index 32cc8cc..0000000
--- a/policies/sc-dbuser/.terraform.lock.hcl
+++ /dev/null
@@ -1,25 +0,0 @@
-# This file is maintained automatically by "terraform init".
-# Manual edits may be lost in future updates.
-
-provider "registry.terraform.io/hashicorp/aws" {
-  version     = "6.37.0"
-  constraints = ">= 6.0.0"
-  hashes = [
-    "h1:w3z/TApcKD3b/aMZoZZKSxOld4xw+gEtQ1ka6C1UN+4=",
-    "zh:0427fadb719ed5a32feb09f047539d2348e659056f3b8a8589d34d8f0a95be7a",
-    "zh:3891c670674aba2125a7ac6d4348cde43646b1b46ce6f829e6f4724091bc0dcd",
-    "zh:632cb24b7b5790b730b33bcbe9f1a7b75f2644fb52f9d6aaafb0249c9e7601d2",
-    "zh:6e96ed1f824c2efa9de5b7c22ab3715624ba34c28564a06e9a15e71bc3d3a30b",
-    "zh:7b8fd86907b659bc45f4a3f42c3c0ccc66925a74e265b01e9e66242c0b2cafef",
-    "zh:81f9a587deddef4dfcc2101c54ec28a3a554056837f68ebb920c83fe8327b16f",
-    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
-    "zh:a9a38a67cb98d690fec951ec3e133b6836279629db2ed3a0ebf97a5bea58674f",
-    "zh:b18f60d62e4bd4d466077e09c39259d1a85355f0f00b801fe8aedbc50193d357",
-    "zh:b7a51bc0faf60d17043b4df1d1b7bb55129eaa4bdeb65ff55f5b00b9b8fee9f7",
-    "zh:c28c42f91ca3a6b65b3fd3ed6e891fc0fc28d0cb5ab65dea65eda8eec5cea5f3",
-    "zh:d895ddc04280ed26b6ca64ca05b78caaa7b72c8e167af4093545efbc608d5482",
-    "zh:f4a56f5157009ef160fbd79105078fe675df479cb73c1b7e1fea2741403a0b67",
-    "zh:f547d6ca371b96fec97b972fc0c93bcfc23d58e34a9da215b94e9d2aa170fb77",
-    "zh:f7b0a3cd4adadd3f4b9609a54e651ed5eafa22c196ab229042fc1d0aa0ab8f3a",
-  ]
-}
diff --git a/policies/sc-dbuser/policy.tf b/policies/sc-dbuser/policy.tf
index 1b2c448..b605dc7 100644
--- a/policies/sc-dbuser/policy.tf
+++ b/policies/sc-dbuser/policy.tf
@@ -1,18 +1,48 @@
 data "aws_iam_policy_document" "inline" {
+  # Read/Describe clusters/instances in RDS
   statement {
-    sid       = "AllowRDSDB"
+    sid       = "AllowRDSDBRead"
     effect    = "Allow"
     resources = ["*"]
     actions = [
-      "rds-db:connect",
       "rds:DescribeDBInstances",
       "rds:DescribeDBClusters",
-      "rds:DescribeDBInstancesPerformance",
-      "rds:DescribeDBClustersPerformance",
+    ]
+  }
+  # Read/Describe performance insights metrics for clusters/instances in RDS
+  statement {
+    sid    = "AllowPerformanceInsightsSelf"
+    effect = "Allow"
+    actions = [
       "pi:DescribeDimensionKeys",
       "pi:GetResourceMetrics",
       "pi:ListAvailableResourceDimensions",
       "pi:ListAvailableResourceMetrics"
     ]
+    # PI resource ARN format: arn:aws:pi:region:account:metrics/rds/db-resource-id
+    # Can't embed dbuser here — PI scopes to the DB resource, not user — leave or separate
+    resources = [format("arn:%v:%v:*:*:%v", data.aws_arn.current.partition, "pi", "metrics/rds/*")]
+  }
+  # Deny rds-db:connect if the session tag UserName is not present (i.e. not authenticated via SSO or STS)
+  statement {
+    sid    = "DenyRDSConnectIfNoTag"
+    effect = "Deny"
+    actions = ["rds-db:connect"]
+    resources = ["*"]
+    condition {
+      test     = "Null"
+      variable = "aws:PrincipalTag/UserName"
+      values   = ["true"]
+    }
+  }
+  # Allow rds-db:connect if the session tag UserName matches the DB username in the resource ARN
+  statement {
+    sid    = "AllowRDSConnectSelf"
+    effect = "Allow"
+    actions = ["rds-db:connect"]
+    resources = [
+      # Scopes to only the DB username matching their session tag
+      format("arn:%v:%v:*:*:%v:*/$${aws:PrincipalTag/UserName}", data.aws_arn.current.partition, "rds-db", "dbuser")
+    ]
   }
 }