diff --git a/modules/aws/vendor-access/README.md b/modules/aws/vendor-access/README.md
index 1220a33..57a1ea3 100644
--- a/modules/aws/vendor-access/README.md
+++ b/modules/aws/vendor-access/README.md
@@ -32,7 +32,7 @@ This module creates the following resources within your AWS account:
   - Authorized to fully manage StreamNative owned EKS cluster, worker nodes, and load balancers
 
 - `role/StreamNativeCloudBootstrapRole` & `policy/StreamNativeCloudBootstrapPolicy`: These IAM resources are used for provisioning, deprovisioning, and regular or emergency maintenance. This role and policy have the following characteristics:
-  - Have the ability to create, delete, manage, and read (within the limits of the permission boundary) EC2, EKS, IAM, DynamoDB, Route53, and KMS resources
+  - Have the ability to create, delete, manage, and read (within the limits of the permission boundary) EC2, EKS, IAM, DynamoDB, Route53, S3, RDS, and KMS resources
   - Cannot create or modify IAM policies (but are allowed to work with IAM policies specified by this module)
   - Can only work with resources that have specific tags associated or certain expected patterns in the resource's friendly name.
 
diff --git a/modules/aws/vendor-access/files/permission_boundary_iam_policy.json.tpl b/modules/aws/vendor-access/files/permission_boundary_iam_policy.json.tpl
index 6214666..f48c12d 100644
--- a/modules/aws/vendor-access/files/permission_boundary_iam_policy.json.tpl
+++ b/modules/aws/vendor-access/files/permission_boundary_iam_policy.json.tpl
@@ -19,6 +19,8 @@
           "kms:*",
           "logs:*",
           "pricing:*",
+          "rds:Describe*",
+          "rds:ListTagsForResource",
           "route53:*",
           "route53domains:*",
           "s3:*",
@@ -35,6 +37,71 @@
       ],
       "Resource": "*"
     },
+    {
+      "Sid": "SQLWorkspaceRDSCreateInstance",
+      "Effect": "Allow",
+      "Action": "rds:CreateDBInstance",
+      "Resource": [
+        "arn:${partition}:rds:${region}:${account_id}:db:sqlworkspace-rds-*",
+        "arn:${partition}:rds:${region}:${account_id}:og:default*",
+        "arn:${partition}:rds:${region}:${account_id}:pg:default*",
+        "arn:${partition}:rds:${region}:${account_id}:subgrp:sqlworkspace-rds-*"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "aws:RequestTag/Vendor": "StreamNative",
+          "rds:DatabaseEngine": "postgres"
+        },
+        "Bool": {
+          "rds:PubliclyAccessible": "false",
+          "rds:StorageEncrypted": "true"
+        }
+      }
+    },
+    {
+      "Sid": "SQLWorkspaceRDSCreateSubnetGroup",
+      "Effect": "Allow",
+      "Action": "rds:CreateDBSubnetGroup",
+      "Resource": "arn:${partition}:rds:${region}:${account_id}:subgrp:sqlworkspace-rds-*",
+      "Condition": {
+        "StringEquals": {
+          "aws:RequestTag/Vendor": "StreamNative"
+        }
+      }
+    },
+    {
+      "Sid": "SQLWorkspaceRDSManage",
+      "Effect": "Allow",
+      "Action": [
+        "rds:DeleteDBInstance",
+        "rds:DeleteDBSubnetGroup",
+        "rds:ModifyDBInstance",
+        "rds:ModifyDBSubnetGroup",
+        "rds:RemoveTagsFromResource"
+      ],
+      "Resource": [
+        "arn:${partition}:rds:${region}:${account_id}:db:sqlworkspace-rds-*",
+        "arn:${partition}:rds:${region}:${account_id}:subgrp:sqlworkspace-rds-*"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "aws:ResourceTag/Vendor": "StreamNative"
+        }
+      }
+    },
+    {
+      "Sid": "SQLWorkspaceRDSFinalSnapshot",
+      "Effect": "Allow",
+      "Action": [
+        "rds:AddTagsToResource",
+        "rds:CreateDBSnapshot"
+      ],
+      "Resource": [
+        "arn:${partition}:rds:${region}:${account_id}:db:sqlworkspace-rds-*",
+        "arn:${partition}:rds:${region}:${account_id}:snapshot:sqlworkspace-rds-*-final-*",
+        "arn:${partition}:rds:${region}:${account_id}:subgrp:sqlworkspace-rds-*"
+      ]
+    },
     {
       "Sid": "IamRestrictions",
       "Effect": "Allow",
diff --git a/modules/aws/vendor-access/files/provision_preserve.json.tpl b/modules/aws/vendor-access/files/provision_preserve.json.tpl
index acc2f2a..7b92f79 100644
--- a/modules/aws/vendor-access/files/provision_preserve.json.tpl
+++ b/modules/aws/vendor-access/files/provision_preserve.json.tpl
@@ -33,6 +33,8 @@
         "kms:ListResourceTags",
         "logs:Describe*",
         "logs:List*",
+        "rds:Describe*",
+        "rds:ListTagsForResource",
         "route53:Get*",
         "route53:List*",
         "s3:ListAllMyBuckets",
@@ -97,6 +99,71 @@
       ],
       "Resource": ["arn:aws:ssm:*:*:session/$${aws:username}-*"]
     },
+    {
+      "Sid": "SQLWorkspaceRDSCreateInstance",
+      "Effect": "Allow",
+      "Action": "rds:CreateDBInstance",
+      "Resource": [
+        "arn:${partition}:rds:${region}:${account_id}:db:sqlworkspace-rds-*",
+        "arn:${partition}:rds:${region}:${account_id}:og:default*",
+        "arn:${partition}:rds:${region}:${account_id}:pg:default*",
+        "arn:${partition}:rds:${region}:${account_id}:subgrp:sqlworkspace-rds-*"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "aws:RequestTag/Vendor": "StreamNative",
+          "rds:DatabaseEngine": "postgres"
+        },
+        "Bool": {
+          "rds:PubliclyAccessible": "false",
+          "rds:StorageEncrypted": "true"
+        }
+      }
+    },
+    {
+      "Sid": "SQLWorkspaceRDSCreateSubnetGroup",
+      "Effect": "Allow",
+      "Action": "rds:CreateDBSubnetGroup",
+      "Resource": "arn:${partition}:rds:${region}:${account_id}:subgrp:sqlworkspace-rds-*",
+      "Condition": {
+        "StringEquals": {
+          "aws:RequestTag/Vendor": "StreamNative"
+        }
+      }
+    },
+    {
+      "Sid": "SQLWorkspaceRDSManage",
+      "Effect": "Allow",
+      "Action": [
+        "rds:DeleteDBInstance",
+        "rds:DeleteDBSubnetGroup",
+        "rds:ModifyDBInstance",
+        "rds:ModifyDBSubnetGroup",
+        "rds:RemoveTagsFromResource"
+      ],
+      "Resource": [
+        "arn:${partition}:rds:${region}:${account_id}:db:sqlworkspace-rds-*",
+        "arn:${partition}:rds:${region}:${account_id}:subgrp:sqlworkspace-rds-*"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "aws:ResourceTag/Vendor": "StreamNative"
+        }
+      }
+    },
+    {
+      "Sid": "SQLWorkspaceRDSFinalSnapshot",
+      "Effect": "Allow",
+      "Action": [
+        "rds:AddTagsToResource",
+        "rds:CreateDBSnapshot"
+      ],
+      "Resource": [
+        "arn:${partition}:rds:${region}:${account_id}:db:sqlworkspace-rds-*",
+        "arn:${partition}:rds:${region}:${account_id}:snapshot:sqlworkspace-rds-*-final-*",
+        "arn:${partition}:rds:${region}:${account_id}:subgrp:sqlworkspace-rds-*"
+      ]
+    },
     {
       "Sid": "ResS3",
       "Effect": "Allow",
@@ -115,9 +182,32 @@
         "s3:PutEncryptionConfiguration"
        ],
        "Resource": [
-          "arn:${partition}:s3:::${bucket_pattern}"
+          "arn:${partition}:s3:::${bucket_pattern}",
+          "arn:${partition}:s3:::*-tiered-storage-snc"
        ]
     },
+    {
+      "Sid": "SQLWorkspaceS3Bucket",
+      "Effect": "Allow",
+      "Action": [
+        "s3:CreateBucket",
+        "s3:DeleteBucket",
+        "s3:DeleteBucketPolicy",
+        "s3:GetAccelerateConfiguration",
+        "s3:GetBucket*",
+        "s3:GetEncryptionConfiguration",
+        "s3:GetLifecycleConfiguration",
+        "s3:GetReplicationConfiguration",
+        "s3:ListBucket",
+        "s3:PutBucketAcl",
+        "s3:PutBucketPolicy",
+        "s3:PutBucketPublicAccessBlock",
+        "s3:PutBucketTagging",
+        "s3:PutEncryptionConfiguration",
+        "s3:PutLifecycleConfiguration"
+      ],
+      "Resource": "arn:${partition}:s3:::rw-*-${account_id}-${region}-*"
+    },
     {
       "Sid": "SvcLnkRl",
       "Effect": "Allow",
@@ -125,4 +215,4 @@
       "Resource": "arn:${partition}:iam::${account_id}:role/aws-service-role/*"
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/modules/aws/vendor-access/files/runtime_iam_policy.json.tpl b/modules/aws/vendor-access/files/runtime_iam_policy.json.tpl
index 7da2f1b..93adc12 100644
--- a/modules/aws/vendor-access/files/runtime_iam_policy.json.tpl
+++ b/modules/aws/vendor-access/files/runtime_iam_policy.json.tpl
@@ -82,7 +82,10 @@
                 "s3:ListMultipart*",
                 "s3:ListBucket"
             ],
-            "Resource": "arn:aws:s3:::${bucket_pattern}"
+            "Resource": [
+                "arn:aws:s3:::${bucket_pattern}",
+                "arn:aws:s3:::*-tiered-storage-snc"
+            ]
         },
         {
             "Sid": "s3o",
@@ -93,7 +96,10 @@
                 "s3:*Object",
                 "s3:*Multipart*"
             ],
-            "Resource": "arn:aws:s3:::${bucket_pattern}"
+            "Resource": [
+                "arn:aws:s3:::${bucket_pattern}",
+                "arn:aws:s3:::*-tiered-storage-snc"
+            ]
         },
         {
             "Sid": "vbc",
diff --git a/modules/aws/vendor-access/main.tf b/modules/aws/vendor-access/main.tf
index 2e526fa..14fc169 100644
--- a/modules/aws/vendor-access/main.tf
+++ b/modules/aws/vendor-access/main.tf
@@ -199,10 +199,11 @@ resource "aws_iam_policy" "provision_preserve_policy" {
   path        = "/StreamNative/"
   policy = templatefile("${path.module}/files/provision_preserve.json.tpl",
     {
-      account_id      = local.account_id
-      bucket_pattern  = var.s3_bucket_pattern
-      partition       = local.aws_partition
-      r53_zone_arns   = local.r53_zone_arns
+      account_id     = local.account_id
+      bucket_pattern = var.s3_bucket_pattern
+      partition      = local.aws_partition
+      r53_zone_arns  = local.r53_zone_arns
+      region         = var.region
   })
   tags = local.tag_set
 }
@@ -214,7 +215,7 @@ resource "aws_iam_policy" "provision_1_policy" {
   path        = "/StreamNative/"
   policy = templatefile("${path.module}/files/provision1.json.tpl",
     {
-      vpc_ids         = local.arn_like_vpcs_str
+      vpc_ids = local.arn_like_vpcs_str
   })
   tags = local.tag_set
 }