CODEWITHSUNDEEP
amazon-web-servicesaws-lambdaamazon-dynamodbamazon-iam
GCSDC
GCSDC

Reputation: 3500

DynamoDB deny access to everyone but administrators and Lambda functions

I have several AWS Lambda functions, each one containing the following aliases (stages): dev, qa and prod.

Each of these functions have some environment variables which should have different values for each alias, but as setting environment variables on an alias level is not supported by Lambda, I've decided to use a DynamoDB table to store the variable values.

Now as these variables contains sensitive information, I would like to make sure that access to this table is as restricted as possible.

So I would like to deny access to everyone and only allow administrators and Lambda functions to access it.

I know that I may provide access to the table by using the appropriate roles/policies on IAM, but how may I make sure that access will only be provided to the users/functions for which I explicitly provided access?

Upvotes: 1

Views: 155

Answers (1)

jarmod
jarmod

Reputation: 78583

Take a look at Parameter Store which is hierarchical and will allow you to set permissions per stage (example here) or you can control based on tags (example here).

Or you could package the parameters with the Lambda function upload.

For more ideas, see this article.

Upvotes: 2

Related Questions