DynamoDB GSI 索引上的访问被拒绝

Question

我写了一个 serverless.yml 来部署一些 lambda，我在特定的 API 中使用 GSI。

如果我运行在本地使用 serverless-offline，它可以工作，但我在部署 lambda 时遇到错误：

AccessDeniedException: User: arn:aws:sts::408462944160:assumed-role/telecom-integration-dev-us-east-1-lambdaRole/integration-dev-dialerStatistics 
is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:408462944160:table/integration-dialer-dev/index/other_dial_status-index

我是这样创建的serverless.yml

 iamRoleStatements:
   - Effect: Allow
     Action:
      - dynamodb:Query
      - dynamodb:Scan
      - dynamodb:GetItem
      - dynamodb:PutItem
      - dynamodb:UpdateItem
      - dynamodb:DeleteItem 
    Resource:        
    - { "Fn::GetAtt": ["DialerDynamoDbTable", "Arn" ] }


dialerStatistics:
  handler: integration/dialer.statistics
  description: Import data on dialer.
  memorySize: 256
  timeout: 30
  events:
    - http:
        path: dialer-statistics
        method: get
        cors: false
        private: false  


DialerDynamoDbTable:
  Type: 'AWS::DynamoDB::Table'
  DeletionPolicy: ${self:provider.environment.DELETION_POLICY}
  # DeletionPolicy: Delete # Useful for recreating environment in dev
  Properties:
    AttributeDefinitions:
      -
        AttributeName: "id"
        AttributeType: "S"
      -
        AttributeName: "dial_status"
        AttributeType: "S"
    KeySchema:
      -
        AttributeName: "id"
        KeyType: "HASH"
    ProvisionedThroughput:
      ReadCapacityUnits: 1
      WriteCapacityUnits: 1
    TableName: ${self:provider.environment.DIALER_TABLE}  
    GlobalSecondaryIndexes:
    - IndexName: "other_dial_status-index"
      KeySchema:
      - AttributeName: "dial_status"
        KeyType: HASH
      Projection:
        ProjectionType: "ALL"
      ProvisionedThroughput:
        ReadCapacityUnits: '20'
        WriteCapacityUnits: '20'

可能缺少对 iAmRoleStatements 的一些权限，但我不确定我还应该做什么。

Answer 1

您的 IAM 角色不涵盖索引。尝试将它们添加到角色的资源中：

iamRoleStatements:
   - Effect: Allow
     Action:
       - dynamodb:Query
       - dynamodb:Scan
       - dynamodb:GetItem
       - dynamodb:PutItem
       - dynamodb:UpdateItem
       - dynamodb:DeleteItem 
     Resource:        
       - { "Fn::GetAtt": ["DialerDynamoDbTable", "Arn" ] }
       - Fn::Join:
         - "/"
         -
           - { "Fn::GetAtt": ["DialerDynamoDbTable", "Arn" ] }
           - "index/*"

作为参考，Fn::Join 会将 /index/* 附加到 DialerDynamoDbTable 的 ARN。

它在本地工作，因为无服务器使用您为其配置的 "admin" IAM 用户。

Answer 2

寻找云形成的人

  PolicyDocument:
    Version: 2012-10-17
    Statement:
    - Effect: Allow
      Action:
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:DeleteItem
        - dynamodb:UpdateItem
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:BatchGetItem
        - dynamodb:BatchWriteItem
      Resource: [!GetAtt DialerDynamoDbTable.Arn, !Join [ '/',[!GetAtt DialerDynamoDbTable.Arn,index/*]]]

Answer 3

Resource: 
    - arn:aws:dynamodb:*:*:table/${self:custom.myTable}
    - arn:aws:dynamodb:*:*:table/${self:custom.myTable}/index/*

DynamoDB GSI 索引上的访问被拒绝

AccessDenied on DynamoDB GSI Index

serverless-framework

serverless