用于访问单独 ARN 资源问题的角色策略答案

【问题标题】：Roles policy to access separate ARN resource issue用于访问单独 ARN 资源问题的角色策略
【发布时间】：2016-03-22 21:37:44
【问题描述】：

我想添加只允许 IAM 用户访问少数表的策略。

关注this document

我的政策：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "cloudwatch:DescribeAlarmHistory",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:DescribeAlarmsForMetric",
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:ListMetrics",
                "datapipeline:DescribeObjects",
                "datapipeline:DescribePipelines",
                "datapipeline:GetPipelineDefinition",
                "datapipeline:ListPipelines",
                "datapipeline:QueryObjects",
                "dynamodb:BatchGetItem",
                "dynamodb:DescribeTable",
                "dynamodb:GetItem",
                "dynamodb:ListTables",
                "dynamodb:Query",
                "dynamodb:Scan",
                "dynamodb:DescribeReservedCapacity",
                "dynamodb:DescribeReservedCapacityOfferings",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "lambda:ListFunctions",
                "lambda:ListEventSourceMappings",
                "lambda:GetFunctionConfiguration"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:dynamodb:eu-west-1: xxxxxxxxxxxx:table:table/<TableName>", //commented real name
                "arn:aws:dynamodb:eu-west-1:xxxxxxxxxxxx:table/<TableName>" //commented real name
            ]
        }
    ]
}

结果我收到“未自动处理”消息

但是当我将资源更改为“*”时 - 一切正常。

那么为什么我不能只对单独的表启用完全读取访问权限？

【问题讨论】：

标签： amazon-web-services amazon amazon-dynamodb amazon-policy

【解决方案1】：

感谢Deepesh S.（来自亚马逊）的解决方案，如下所列

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ResourceBasedActions",
            "Action": [
                "datapipeline:DescribeObjects",
                "datapipeline:DescribePipelines",
                "datapipeline:GetPipelineDefinition",
                "datapipeline:QueryObjects",
                "dynamodb:BatchGetItem",
                "dynamodb:DescribeTable",
                "dynamodb:GetItem",
                "dynamodb:Query",
                "dynamodb:Scan",
                "lambda:GetFunctionConfiguration"
            ],
            "Effect": "Allow",
            "Resource": [
                 "arn:aws:dynamodb:eu-west-1: xxxxxxxxxxxx:table:table/<TableName>", 
                "arn:aws:dynamodb:eu-west-1:xxxxxxxxxxxx:table/<TableName>" 
            ]
        },
        {
            "Sid": "NonResourceBasedActions",
            "Action": [
                "cloudwatch:DescribeAlarmHistory",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:DescribeAlarmsForMetric",
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:ListMetrics",
                "datapipeline:ListPipelines",
                "dynamodb:ListTables",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "lambda:ListFunctions",
                "lambda:ListEventSourceMappings",
                "dynamodb:DescribeReservedCapacity",
                "dynamodb:DescribeReservedCapacityOfferings"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ]
        }
    ]
}

【讨论】：