DynamoDB 中的细粒度访问

Question

我的用户在Facebook和表格上注册时有基本的用户信息。我希望用户只更新、删除等自己的记录，但也能够对所有其他用户的属性具有读取访问权限。例如，看到他们的名字。如何创建允许此操作的策略？这是针对方案 1：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "FullAccessToUserItems",
        "Effect": "Allow",
        "Action": [
            "dynamodb:GetItem",
            "dynamodb:BatchGetItem",
            "dynamodb:Query",
            "dynamodb:PutItem",
            "dynamodb:UpdateItem",
            "dynamodb:DeleteItem",
            "dynamodb:BatchWriteItem"
        ],
        "Resource": [
            "arn:aws:dynamodb:us-west-2:123456789012:table/Users"
        ],
        "Condition": {
            "ForAllValues:StringEquals": {
                "dynamodb:LeadingKeys": [
                      "${graph.facebook.com:id}"
                ]
            }
        }
    }
]

}

Answer 1

只需添加另一个对整个表具有读取权限的语句即可。

这样的事情应该有效：

{
    "Sid": "ReadAccess",
    "Effect": "Allow",
    "Action": [
        "dynamodb:GetItem",
        "dynamodb:BatchGetItem",
        "dynamodb:Query"
    ],
    "Resource": [
        "arn:aws:dynamodb:us-west-2:123456789012:table/Users"
    ]
}

整个政策就是这样。请注意底部的第二条语句：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "FullAccessToUserItems",
        "Effect": "Allow",
        "Action": [
            "dynamodb:GetItem",
            "dynamodb:BatchGetItem",
            "dynamodb:Query",
            "dynamodb:PutItem",
            "dynamodb:UpdateItem",
            "dynamodb:DeleteItem",
            "dynamodb:BatchWriteItem"
        ],
        "Resource": [
            "arn:aws:dynamodb:us-west-2:123456789012:table/Users"
        ],
        "Condition": {
            "ForAllValues:StringEquals": {
                "dynamodb:LeadingKeys": [
                      "${graph.facebook.com:id}"
                ]
            }
        }
    },
    {
        "Sid": "ReadAccess",
        "Effect": "Allow",
        "Action": [
            "dynamodb:GetItem",
            "dynamodb:BatchGetItem",
            "dynamodb:Query"
        ],
        "Resource": [
            "arn:aws:dynamodb:us-west-2:123456789012:table/Users"
        ]
    }
]
}