Teleport can bootstrap IAM permissions for the Database Service based on its
configuration using the `teleport db configure bootstrap` command. You can use
this command in automatic or manual mode:

- In automatic mode, Teleport will attempt to create appropriate IAM policies
  and attach them to the specified IAM identity (user or role). This requires
  IAM permissions to create and attach IAM policies.
- In manual mode, Teleport will print required IAM policies. You can then create
  and attach them manually using the AWS management console.

Run one of the following commands on your Database Service node:

<Tabs>
  <TabItem label="Automatic / IAM User">
  Use this command to bootstrap the permissions automatically when
  your Teleport Database Service runs as an IAM user (for example, uses an AWS
  credentials file).

  ```code
  $ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-user TeleportUser
  ```
  </TabItem>

  <TabItem label="Automatic / IAM Role">
  Use this command to bootstrap the permissions automatically when
  your Teleport Database Service runs as an IAM role (for example, on an EC2
  instance with an attached IAM role).

  ```code
  $ teleport db configure bootstrap -c /etc/teleport.yaml --attach-to-role TeleportRole
  ```
  </TabItem>

  <TabItem label="Manual">
  Use this command to display required IAM policies which you will then create in your AWS console:

  ```code
  $ teleport db configure bootstrap -c /etc/teleport.yaml --manual
  ```
  </TabItem>
</Tabs>

See the full `bootstrap` command
[reference](../../database-access/reference/cli.mdx#teleport-db-configure-bootstrap).