Create a policy like this, substituting your AWS account number, then attach it to all groups and roles. It will prevent deletion of RDS instances containing the string "prod" in their name.
Note: This is intended to prevent accidental deletion, and is easily sidestepped.
| <!doctype html> | |
| <title>Site Maintenance</title> | |
| <style> | |
| body { text-align: center; padding: 150px; } | |
| h1 { font-size: 50px; } | |
| body { font: 20px Helvetica, sans-serif; color: #333; } | |
| article { display: block; text-align: left; width: 650px; margin: 0 auto; } | |
| a { color: #dc8100; text-decoration: none; } | |
| a:hover { color: #333; text-decoration: none; } | |
| </style> |
| route53domains:RegisterDomain | |
| route53domains:RenewDomain | |
| route53domains:TransferDomain | |
| ec2:ModifyReservedInstances | |
| ec2:PurchaseHostReservation | |
| ec2:PurchaseReservedInstancesOffering | |
| ec2:PurchaseScheduledInstances | |
| rds:PurchaseReservedDBInstancesOffering | |
| dynamodb:PurchaseReservedCapacityOfferings | |
| s3:PutObjectRetention |