title: Unable to call describe_db_instances in aws lambda due to permission issue
body: <p>I want to be able to run the following code:</p>
  
  <pre><code>rds = boto3.client("rds")
  filters = [{
      "Name": "tag:Name",
      "Values": [f"*-{DB_SUFFIX}"]
  }]
  to_drop_dbs = rds.describe_db_instances(Filters=filters)
  </code></pre>
  
  <p>in order to select a list of db identifiers that has a common suffix.</p>
  
  <p>I have encountered this error when I tried to run </p>
  
  <blockquote>
    <p>An error occurred (AccessDenied) when calling the DescribeDBInstances
    operation: User:
    arn:aws:sts::888999792464:assumed-role/dev.lambda/list-all-dbs is not
    authorized to perform: rds:DescribeDBInstances: ClientError</p>
  </blockquote>
  
  <p>This is my policy statement for my lambda function in a terraform.</p>
  
  <pre><code>{   
      "Version": "2012-10-17",   
      "Statement": [  {
        "Effect": "Allow",
         "Action": [
           "rds:DescribeDBInstances"
         ],
         "Resource": [
           "arn:aws:rds:${var.region}:${local.account_id}:db:*"
        ]
       }]
   }
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/DlgRx.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DlgRx.png" alt="enter image description here"></a></p>
  
  <p>I tried the policy in the policy simulator. It fails as well, and there is no resource to specify.</p>
  
  <p>My question:</p>
  
  <p>How can I fix my policy?</p>