AWS CDK（Python）添加DynamoDB：一个或多个全局次级索引的查询权限
没有使用权限
我有一个CDK部署的Python lambda函数当前未能针对DynamoDB表执行查询，因为在调用查询操作时使用引用索引：（AccessDeniedException）在调用查询操作时 ： ：XXX无权执行：DynamoDB：在资源上查询： ARN：AWS：DynamoDB：AP-Southeast-2：XXX/index/my-Index，因为没有基于身份的策略允许DynamoDB：Query Action
目前我正在使用以下CDK命令将DynamoDB权限分配给lambda函数。为了添加索引的查询权限，我需要指定什么？
# grant permissions for lambda to read/write to DynamoDB table and bucket
table.grant_read_write_data(lambda_function)
table.grant_read_data(api_lambda_function)
bucket.grant_read_write(lambda_function)
bucket_storage.grant_read_write(lambda_function)
bucket_storage.grant_read(api_lambda_function)
I have a CDK deployed Python Lambda function currently failing to execute queries against a DynamoDb table because the permission isn't there for utilising the referenced index:
(AccessDeniedException) when calling the Query operation: User: arn:aws:sts::xxx is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:ap-southeast-2:xxx/index/my-index because no identity-based policy allows the dynamodb:Query action
At present I'm using the following CDK commands to assign DynamoDb permissions to the Lambda function(s). What would I need to specify in order to add query permissions for index(es)?
# grant permissions for lambda to read/write to DynamoDB table and bucket
table.grant_read_write_data(lambda_function)
table.grant_read_data(api_lambda_function)
bucket.grant_read_write(lambda_function)
bucket_storage.grant_read_write(lambda_function)
bucket_storage.grant_read(api_lambda_function)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
因为您已经在CDK之外创建了索引，所以您必须自己添加权限。通过A to function.add_to_role_policy 。可以找到一组广泛的语句
操作在这里。适当地缩小它们。将索引资源指定为：arn：aws：dynamodb：us-west-2：0123456789012：table/mytable/mytable/index/myindex（index/index/*for All Index）。如果您使用
add_global_secondary_index创建索引，则NB CDK将添加权限。当表创建表时，您可以多次调用此方法。在后续表更新中，但是，DynamoDB将您限制为Because you've created the indexes outside the CDK, you will have to add the permissions yourself. Pass a PolicyStatement to function.add_to_role_policy. A broad set of statement
actionscan be found here. Narrow them as appropriate. Specify the index resource as:arn:aws:dynamodb:us-west-2:0123456789012:table/MyTable/index/MyIndex(index/*for all indexes).N.B. CDK will add the permissions if you create the index with
add_global_secondary_index. You can call this method multiple times when creating the table. During subsequent table updates, however, DynamoDB limits you to one new GSI per update operation.