updates from review

policies/sc-dbuser/policy.tf

@@ -1,18 +1,48 @@
 data "aws_iam_policy_document" "inline" {
+  # Read/Describe clusters/instances in RDS
   statement {
-    sid       = "AllowRDSDB"
+    sid       = "AllowRDSDBRead"
     effect    = "Allow"
     resources = ["*"]
     actions = [
-      "rds-db:connect",
       "rds:DescribeDBInstances",
       "rds:DescribeDBClusters",
-      "rds:DescribeDBInstancesPerformance",
-      "rds:DescribeDBClustersPerformance",
+    ]
+  }
+  # Read/Describe performance insights metrics for clusters/instances in RDS
+  statement {
+    sid    = "AllowPerformanceInsightsSelf"
+    effect = "Allow"
+    actions = [
       "pi:DescribeDimensionKeys",
       "pi:GetResourceMetrics",
       "pi:ListAvailableResourceDimensions",
       "pi:ListAvailableResourceMetrics"
     ]
+    # PI resource ARN format: arn:aws:pi:region:account:metrics/rds/db-resource-id
+    # Can't embed dbuser here — PI scopes to the DB resource, not user — leave or separate
+    resources = [format("arn:%v:%v:*:*:%v", data.aws_arn.current.partition, "pi", "metrics/rds/*")]
+  }
+  # Deny rds-db:connect if the session tag UserName is not present (i.e. not authenticated via SSO or STS)
+  statement {
+    sid    = "DenyRDSConnectIfNoTag"
+    effect = "Deny"
+    actions = ["rds-db:connect"]
+    resources = ["*"]
+    condition {
+      test     = "Null"
+      variable = "aws:PrincipalTag/UserName"
+      values   = ["true"]
+    }
+  }
+  # Allow rds-db:connect if the session tag UserName matches the DB username in the resource ARN
+  statement {
+    sid    = "AllowRDSConnectSelf"
+    effect = "Allow"
+    actions = ["rds-db:connect"]
+    resources = [
+      # Scopes to only the DB username matching their session tag
+      format("arn:%v:%v:*:*:%v:*/$${aws:PrincipalTag/UserName}", data.aws_arn.current.partition, "rds-db", "dbuser")
+    ]
   }
 }