DynamoDB 索引查询的 ARN 不起作用

Question

我想查询 DynamoDB 中的索引 table。这样做时出现以下错误：

User: arn:aws:sts::XXX:assumed-role/bifr-dev-us-east-1-lambdaRole/bifr-dev-login is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:XXX:table/customers/index/email_index

在尝试使用中建议的配置以及 AWS 和 DynamoDB 权限修复它后："User is not authorized to access this resource" 我使用了以下配置，但仍然无法正常工作。同样的错误仍然存在。也许有人可以帮我解决这个问题。

Table 配置：

resources: 
      Resources:
        customers: 
          Type: AWS::DynamoDB::Table
          Properties:
            TableName: customers
            AttributeDefinitions:
              - AttributeName: "id"
                AttributeType: S
              - AttributeName: "email"
                AttributeType: S
            KeySchema:
              - AttributeName: "id"
                KeyType: HASH
            BillingMode: PAY_PER_REQUEST
            GlobalSecondaryIndexes: 
            - IndexName: 'email_index'
              KeySchema:
              - AttributeName: 'email'
                KeyType: 'HASH'
              Projection: 
                ProjectionType: 'ALL'

IAM 角色配置：

iamRoleStatements:
- Effect: Allow
  Action:
    - dynamodb:GetItem
    - dynamodb:UpdateItem
    - dynamodb:PutItem
    - dynamodb:Scan
  Resource: "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/*"
- Effect: Allow
  Action:
    - dynamodb:Query
  Resource: "arn:aws:dynamodb:us-east-1:250781267785:table/customers/index/email_index"

查询的 NodeJS 代码：

var res = await aws.QueryItems({
    TableName: tableName,

    IndexName: 'email_index',
    KeyConditionExpression: '#email = :email',
    ExpressionAttributeNames: {
        "#email": "email"
    },
    ExpressionAttributeValues: {
        ":email": email
    }
});

Answer 1

根据https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazondynamodb.html#amazondynamodb-table

您需要将 table 的 ARN 添加到 dynamodb:Query IAM 语句。

Answer 2

问题是缩进。 iamRoleStatements 必须是 provider 的子项。

这是我的工作配置：

provider:
  name: aws
  runtime: nodejs12.x
  region: us-east-1
  iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:GetItem
          - dynamodb:UpdateItem
          - dynamodb:PutItem
          - dynamodb:Scan
        Resource: "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/*"
      - Effect: Allow
        Action:
          - dynamodb:Query
        Resource: "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/customers/index/*"

DynamoDB 索引查询的 ARN 不起作用

ARN for Query on DynamoDB index is not working

amazon-cloudformation

amazon-dynamodb

aws-lambda

serverless-framework

Table 配置：

IAM 角色配置：

查询的 NodeJS 代码：