I’m implementing IAM authentication for Amazon RDS instances (not Aurora) and managing IAM users through the IAM Identity Center. I have individual database user accounts corresponding to each IAM user, and I want to attach IAM policies dynamically based on the IAM user’s username (email address).

In my IAM policies, I need to specify the database username in the resource ARN for each IAM user to restrict access to their respective database user accounts. However, I’m unsure how to dynamically retrieve the IAM Identity Center user names and use them in the IAM policy.

Here’s an example of what I’m trying to achieve:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "rds-db:connect",
            "Resource": "arn:aws:rds-db:region:account-id:dbuser:db-instance-identifier/${IAM Identity Center User Name}"
        }
    ]
}

I want to dynamically replace ${IAM Identity Center User Name} with the actual IAM Identity Center user name (email address).

I looked up the documentation for identitystore:UserId ; but it says it will give ID not the user name.

Is there a way to achieve this using IAM policy variables or conditions? How can I dynamically construct IAM policies based on the IAM Identity Center user names to control access to my RDS instances securely?

Any guidance or suggestions would be greatly appreciated. Thank you!