CODEWITHSUNDEEP
amazon-dynamodbamazon-iam
Richard Wong
Richard Wong

Reputation: 3578

Can wildcard character (*) be used in the fine-grained access policy for dynamodb?

I have a Amazon dynamodb table with partition key composed of the user's id (from facebook or google) and other characters. I know wildcard can be used to specify the properties of a fine-grained access policy, but I couldn't get the wildcard in the dynamodb:LeadingKeys working.

Here is the working policy:

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "dynamodb:BatchGetItem",
              "dynamodb:BatchWriteItem",
              "dynamodb:DeleteItem",
              "dynamodb:GetItem",
              "dynamodb:PutItem",
              "dynamodb:Query",
              "dynamodb:UpdateItem"
          ],
          "Resource": [
              "arn:aws:dynamodb:<region>:<...>:table/<table-name>"
          ],
          "Condition": {
              "ForAllValues:StringEquals": {
                  "dynamodb:LeadingKeys": [
                      "g_${accounts.google.com:sub}"
                  ]
              }
          }
      }
  ]
}

However, this doesn't work:

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "dynamodb:BatchGetItem",
              "dynamodb:BatchWriteItem",
              "dynamodb:DeleteItem",
              "dynamodb:GetItem",
              "dynamodb:PutItem",
              "dynamodb:Query",
              "dynamodb:UpdateItem"
          ],
          "Resource": [
              "arn:aws:dynamodb:<region>:<...>:table/<table-name>"
          ],
          "Condition": {
              "ForAllValues:StringEquals": {
                  "dynamodb:LeadingKeys": [
                      "*_${accounts.google.com:sub}"
                  ]
              }
          }
      }
  ]
}

Upvotes: 16

Views: 6808

Answers (1)

Richard Wong
Richard Wong

Reputation: 3578

I found the solution to this. So instead of using ForAllValues:StringEquals, use ForAllValues:StringLike.

The working policy is such:

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "dynamodb:BatchGetItem",
              "dynamodb:BatchWriteItem",
              "dynamodb:DeleteItem",
              "dynamodb:GetItem",
              "dynamodb:PutItem",
              "dynamodb:Query",
              "dynamodb:UpdateItem"
          ],
          "Resource": [
              "arn:aws:dynamodb:<region>:<...>:table/<table-name>"
          ],
          "Condition": {
              "ForAllValues:StringLike": {
                  "dynamodb:LeadingKeys": [
                      "*_${accounts.google.com:sub}"
                  ]
              }
          }
      }
  ]
}

Took me a while to find this reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#AccessPolicyLanguage_ConditionType

Upvotes: 31

Related Questions