Lambda is not authorized to perform: dynamodb:GetItem

user_7338454 0
Viewed 725

I have an IAM group that assigns some permissions to its users. One of many permissions is access to Lambda functions. These lambda functions add simple comments in a DynamoDB table. For the user attempting to test the Lambda in the AWS console, the response is this:

User: arn:aws:sts::11111111111:assumed-role/jd-176-LambdaToDynamoDBCommentTableRole-1QGT8KW7YAUAA/jd-176-LambdaCreationHelperSta-SaveCommentFunction-LQRLLIVVRDS5 is not authorized to perform: dynamodb:GetItem on resource: arn:aws:dynamodb:us-east-1:11111111111:table/aws-serverless-config

Which is strange because it looks like I allow dynamodb:GetItem, among others on arn:aws:dynamodb:us-east-1:11111111111:table/aws-serverless-config.

LambdaToDynamoDBCommentTableRole:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Action": [
            "dynamodb:DeleteItem",
            "dynamodb:GetItem",
            "dynamodb:BatchGetItem",
            "dynamodb:PutItem",
            "dynamodb:Query",
            "dynamodb:Scan",
            "dynamodb:UpdateItem"
        ],
        "Resource": [
            "arn:aws:dynamodb:us-east-1:11111111111:table/jd-176-BlogComment",
            "arn:aws:dynamodb:us-east-1:11111111111:table/jd-176-serverless-config"
        ],
        "Effect": "Allow",
        "Sid": "AllowDynamoDB"
    }
]

}

I'd really appreciate any help here. If any more information is needed, I'm happy to provide.

amazon-iam aws-lambda amazon-web-services
1 Answers

The error message is correct. It shows that you are trying to access aws-serverless-config table, but your LambdaToDynamoDBCommentTableRole only allows access to:

  • jd-176-BlogComment
  • jd-176-serverless-config

If you want to allow access to aws-serverless-config, you have to add it to LambdaToDynamoDBCommentTableRole:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Action": [
            "dynamodb:DeleteItem",
            "dynamodb:GetItem",
            "dynamodb:BatchGetItem",
            "dynamodb:PutItem",
            "dynamodb:Query",
            "dynamodb:Scan",
            "dynamodb:UpdateItem"
        ],
        "Resource": [
            "arn:aws:dynamodb:us-east-1:11111111111:table/jd-176-BlogComment",
            "arn:aws:dynamodb:us-east-1:11111111111:table/jd-176-serverless-config",
            "arn:aws:dynamodb:us-east-1:11111111111:table/aws-serverless-config"
        ],
        "Effect": "Allow",
        "Sid": "AllowDynamoDB"
    }
 ]
}
user_2488230
Related