DynamoDB GSI索引上的访问被拒绝

Question

我已经编写了一个serverless.yml来部署一些lambdas，并且我正在特定的API中使用GSI。

如果我使用无服务器离线在本地运行，它是有效的，但在部署lambda:时遇到错误

AccessDeniedException: User: arn:aws:sts::408462944160:assumed-role/telecom-integration-dev-us-east-1-lambdaRole/integration-dev-dialerStatistics 
is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:408462944160:table/integration-dialer-dev/index/other_dial_status-index

以下是我如何创建serverless.yml

iamRoleStatements:
- Effect: Allow
Action:
- dynamodb:Query
- dynamodb:Scan
- dynamodb:GetItem
- dynamodb:PutItem
- dynamodb:UpdateItem
- dynamodb:DeleteItem 
Resource:        
- { "Fn::GetAtt": ["DialerDynamoDbTable", "Arn" ] }

dialerStatistics:
handler: integration/dialer.statistics
description: Import data on dialer.
memorySize: 256
timeout: 30
events:
- http:
path: dialer-statistics
method: get
cors: false
private: false  

DialerDynamoDbTable:
Type: 'AWS::DynamoDB::Table'
DeletionPolicy: ${self:provider.environment.DELETION_POLICY}
# DeletionPolicy: Delete # Useful for recreating environment in dev
Properties:
AttributeDefinitions:
-
AttributeName: "id"
AttributeType: "S"
-
AttributeName: "dial_status"
AttributeType: "S"
KeySchema:
-
AttributeName: "id"
KeyType: "HASH"
ProvisionedThroughput:
ReadCapacityUnits: 1
WriteCapacityUnits: 1
TableName: ${self:provider.environment.DIALER_TABLE}  
GlobalSecondaryIndexes:
- IndexName: "other_dial_status-index"
KeySchema:
- AttributeName: "dial_status"
KeyType: HASH
Projection:
ProjectionType: "ALL"
ProvisionedThroughput:
ReadCapacityUnits: '20'
WriteCapacityUnits: '20'

可能它缺少对iAmRoleStatements的一些权限，但我不确定我还应该做什么。

Answer 1

IAM角色不包括索引。尝试将它们添加到角色的资源中：

iamRoleStatements:
- Effect: Allow
Action:
- dynamodb:Query
- dynamodb:Scan
- dynamodb:GetItem
- dynamodb:PutItem
- dynamodb:UpdateItem
- dynamodb:DeleteItem 
Resource:        
- { "Fn::GetAtt": ["DialerDynamoDbTable", "Arn" ] }
- Fn::Join:
- "/"
-
- { "Fn::GetAtt": ["DialerDynamoDbTable", "Arn" ] }
- "index/*"

作为参考，Fn:：Join将把/index/*附加到DialerDynamoDbTable的ARN中。

它在本地工作，因为Serverless使用您为其配置的"admin"IAM用户。

Answer 2

Resource: 
- arn:aws:dynamodb:*:*:table/${self:custom.myTable}
- arn:aws:dynamodb:*:*:table/${self:custom.myTable}/index/*

Answer 3

对于那些搜索云形成的人

PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- dynamodb:GetItem
- dynamodb:PutItem
- dynamodb:DeleteItem
- dynamodb:UpdateItem
- dynamodb:Query
- dynamodb:Scan
- dynamodb:BatchGetItem
- dynamodb:BatchWriteItem
Resource: [!GetAtt DialerDynamoDbTable.Arn, !Join [ '/',[!GetAtt DialerDynamoDbTable.Arn,index/*]]]