title: AWS Cloudformation : Does CloudWatch Alarm for RDS needs IAM role?
body: <p>I want to get a notification email whenever my RDS instance has available storage space less than a threshold value for example 2GB.</p>
  <p>I created an alarm from the AWS console that monitors the FreeStorageSpace metric for the above reason.</p>
  <p>Now I want to put this alarm snippet in my existing Cloudformation template to link this alarm to my existing RDS instance. Do I need to create any kind of IAM role for the RDS?</p>
  <pre><code>    Type: AWS::CloudWatch::Alarm
      Properties:
        AlarmName: RDS Low Storage Alarm
        AlarmDescription: This alarm is triggered when RDS storage is lower than or equal to 5GB
      ActionsEnabled: true
      OKActions: []
      AlarmActions:
        - arn:aws:sns:ap-northeast-1:1234567890:stg1-init-AlertTopic-1WPRQT95IHBJZ
      InsufficientDataActions: []
      MetricName: FreeStorageSpace
      Namespace: AWS/RDS
      Statistic: Average
      Dimensions:
       - Name: DBInstanceIdentifier
         Value: xxx1blsxxxxel
      Period: 60
      EvaluationPeriods: 1
      DatapointsToAlarm: 1
      Threshold: 5368709120
      ComparisonOperator: LessThanOrEqualToThreshold
      TreatMissingData: missing
  </code></pre>
  <p>I found several articles like <a href="https://aws.amazon.com/premiumsupport/knowledge-center/storage-full-rds-cloudwatch-alarm/" rel="nofollow noreferrer">this</a> where alarm creation like above is explained. But I found no information about IAM things.</p>
  <p><strong>Update:</strong>
  The SNS Alert topic I have created in my main cfn template has the below access policy as a default. In this case, Will it be enough just to create the above alarm?</p>
  <pre><code>{
    &quot;Version&quot;: &quot;2008-10-17&quot;,
    &quot;Id&quot;: &quot;__default_policy_ID&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Sid&quot;: &quot;__default_statement_ID&quot;,
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;AWS&quot;: &quot;*&quot;
        },
        &quot;Action&quot;: [
          &quot;SNS:GetTopicAttributes&quot;,
          &quot;SNS:SetTopicAttributes&quot;,
          &quot;SNS:AddPermission&quot;,
          &quot;SNS:RemovePermission&quot;,
          &quot;SNS:DeleteTopic&quot;,
          &quot;SNS:Subscribe&quot;,
          &quot;SNS:ListSubscriptionsByTopic&quot;,
          &quot;SNS:Publish&quot;,
          &quot;SNS:Receive&quot;
        ],
        &quot;Resource&quot;: &quot;arn:aws:sns:ap-northeast-1:333333333333:stg1-init-AlertTopic-1WPRQT95IHBJZ&quot;,
        &quot;Condition&quot;: {
          &quot;StringEquals&quot;: {
            &quot;AWS:SourceOwner&quot;: &quot;333333333333&quot;
          }
        }
      }
    ]
  }
  </code></pre>