CODEWITHSUNDEEP
amazon-web-servicesamazon-iam
kerlant
kerlant

Reputation: 23

AWS IAM policy restriction based on Tags not giving me any access

So I followed this AWS tutorial and created this IAM policy that should give access to any dynamodb action that has these keys. But as you can see in the image attached, it tells me I do not have any permission. Also it does happen to other services, so not only dynamodb, and also I tried to hardcode the 'access-project' tag in the policy as done with the 'access-environment as you can see.

{
    "Version": "2012-10-17",
    "Statement": [
        {
         "Sid": "AllActionsSameProjectEnvironment",
         "Effect": "Allow",
         "Action": "dynamodb:*",
         "Resource": "*",
         "Condition": {
               "StringEquals": {
                 "aws:ResourceTag/access-project": "${aws:PrincipalTag/access-project}",
                 "aws:ResourceTag/access-environment": "pre"
             },
             "ForAllValues:StringEquals": {
                 "aws:TagKeys": [
                     "access-project",
                     "access-environment",
                     "Name",
                     "OwnedBy"
                 ]
             },
             "StringEqualsIfExists": {
                 "aws:RequestTag/access-project": "${aws:PrincipalTag/access-project}",
                 "aws:RequestTag/access-environment": "pre"
             }
         }
     }
]
}

error image

Any idea why is this happening? Thanks!

Upvotes: 1

Views: 530

Answers (1)

Marcin
Marcin

Reputation: 238747

DynamoDB does not support Authorization based on tags as listed in the docs.

Upvotes: 1

Related Questions