aws-lambda - 无法从 Lambda 函数查询 DynamoDB 表

Question

执行 Lambda 函数时收到错误:

"AccessDeniedException: User: arn:aws:sts::342213474092:assumed-role/testServerlessStack-ExecRole-YZCIWMHK86D8/testServerlessStack-GetFailureKeysByOrder-OR3YS1NLQY0M is not authorized to perform: dynamodb:Scan on resource: arn:aws:dynamodb:us-east-2:342213474092:table/Bar"

该函数的执行角色具有以下权限:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "dynamodb:Query",
                "dynamodb:Scan"
            ],
            "Resource": [
                "arn:aws:dynamodb:us-east-2:342213474092:table/Foo/*",
                "arn:aws:dynamodb:us-east-2:342213474092:table/Bar/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Lambda 查询 Foo，然后扫描 Bar。

Answer 1

根据文档，资源的格式应为:

查询表:arn:aws:dynamodb:区域:帐户 ID:表/表名称

或者:arn:aws:dynamodb:区域:帐户 ID:表/*

扫描也是如此:

扫描表:arn:aws:dynamodb:区域:帐户 ID:表/表名称

或者:arn:aws:dynamodb:区域:帐户 ID:表/*

您是否尝试过将资源更改为:

"Resource": [
            "arn:aws:dynamodb:us-east-2:342213474092:table/Foo",
            "arn:aws:dynamodb:us-east-2:342213474092:table/Bar"
        ],

此处的文档:DynamoDB API permissions

根据您最后的评论，这应该适合您:

arn:aws:dynamodb:region:account-id:table/*/index/*