amazon-dynamodb - AWS AppSync IAM DynamoDb 角色

Question

我正在尝试创建一个简单的 IAM 角色，以使我的 AppSync 服务连接到我的 DynamoDb 数据库，但由于 AppSync 处于预览状态，IAM 无法将 AppSync 识别为服务。如何创建 IAM 角色以让 AppSync 拥有对 DynamoDb 的完全访问权限？

Answer 1

信任关系方面看起来像这样

可信关系文档示例

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "appsync.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

政策文档基本上和往常一样

示例策略文档

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "dynamodb:PutItem",
                "dynamodb:UpdateItem",
                "dynamodb:DeleteItem",
                "dynamodb:GetItem",
                "dynamodb:Query",
                "dynamodb:Scan"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

如果您使用的是 CloudFormation 模板，它可能如下所示

CloudFormation 模板示例

  AppSyncRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "appsync.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        -
          PolicyName: "appsync-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - "dynamodb:PutItem"
                  - "dynamodb:UpdateItem"
                  - "dynamodb:DeleteItem"
                  - "dynamodb:GetItem"
                  - "dynamodb:Query"
                  - "dynamodb:Scan"
                Resource: "*"