AWS DynamoDB IAM策略 - 拒绝查询特定属性
我很难做到这一点。我设置了首先允许查询的策略，以便lambda可以访问我的表格，但是我需要它以防止查询一些特定属性。我可以使用带有StringNotequal的允许的允许，但是我希望拒绝拒绝，因此，如果有人在策略后以后添加其他条件，他们不会意外地授予对受限属性的访问。这是我的两个政策声明：
const psAllow = new PolicyStatement({
resources: [tableArn],
actions: ['dynamodb:GetItem','dynamodb:BatchGetItem','dynamodb:Query','dynamodb:Scan'],
effect: Effect.ALLOW
});
const psDeny = new PolicyStatement({
resources: [tableArn],
actions: ['dynamodb:GetItem','dynamodb:BatchGetItem','dynamodb:Query', 'dynamodb:Scan'],
effect: Effect.DENY
});
psDeny.addCondition('StringEquals', {'dynamodb:Select':'SPECIFIC_ATTRIBUTES'});
psDeny.addCondition('ForAllValues:StringEquals', {'dynamodb:Attributes':['restricted_field1','restricted_field2']});
如果我省略了条件，则拒绝将覆盖允许并正确防止DynamoDB查询。一旦我添加条件，否认就被完全忽略了。我必须格式化条件错误，或者只是在这里缺少一些东西。有什么想法吗？
I'm having trouble getting this to work. I setup a policy to first allow a query so the lambda can access my table, but I need it to prevent query on a few specific attributes. I can make it work using an allow with StringNotEquals but I would prefer a DENY so if someone were to add another condition to the policy later they dont accidentally grant access to the restricted attributes. Here's my two Policy Statements:
const psAllow = new PolicyStatement({
resources: [tableArn],
actions: ['dynamodb:GetItem','dynamodb:BatchGetItem','dynamodb:Query','dynamodb:Scan'],
effect: Effect.ALLOW
});
const psDeny = new PolicyStatement({
resources: [tableArn],
actions: ['dynamodb:GetItem','dynamodb:BatchGetItem','dynamodb:Query', 'dynamodb:Scan'],
effect: Effect.DENY
});
psDeny.addCondition('StringEquals', {'dynamodb:Select':'SPECIFIC_ATTRIBUTES'});
psDeny.addCondition('ForAllValues:StringEquals', {'dynamodb:Attributes':['restricted_field1','restricted_field2']});
If I omit the conditions the DENY will override the ALLOW and correctly prevent the dynamodb query. As soon as I add a condition the DENY is totally ignored. I must be formatting the condition wrong or just missing something here. Any ideas?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我认为您应该在拒绝语句中使用
foranyValues（而不是forallValues）。I think you should use
ForAnyValues(instead ofForAllValues) in the deny statement.