AWS Lambda - (AccessDeniedException) when calling the Scan operation User is not authorized to perform: dynamodb: Scan

Question

I try to access dynamodb via boto3 (Python) in AWS. Got this working on my local machine. As I understand in AWS running, it just uses IAM roles to get access. But it does not work.

  Lambda execution failed with status 200 due to customer function error: An error occurred (AccessDeniedException) when calling the Scan operation: 

  User: arn:aws:sts::021517822274:assumed-role/CodeStar-tt-api-subjects-Execution/

  awscodestar-tt-api-subjects-lambda-HelloWorld is not authorized to perform: dynamodb:

  Scan on resource: arn:aws:dynamodb:us-east-1:021517822274:table/tt-subjects. 

Quite the same question was send here:

How to solve (AccessDeniedException) when calling the Scan operation: User: arn:aws:sts... is not authorized to perform: dynamodb:Scan on resource.."?

And I applied the suggested AmazonDynamoDBFullAccess policy. Tried also those:

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_dynamodb_specific-table.html

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_lambda-access-dynamodb.html

My own added policy (in addition) is:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListAndDescribe",
            "Effect": "Allow",
            "Action": [
                "dynamodb:List*",
                "dynamodb:DescribeReservedCapacity*",
                "dynamodb:DescribeLimits",
                "dynamodb:DescribeTimeToLive"
            ],
            "Resource": "*"
        },
        {
            "Sid": "SpecificTable",
            "Effect": "Allow",
            "Action": [
                "dynamodb:BatchGet*",
                "dynamodb:DescribeStream",
                "dynamodb:DescribeTable",
                "dynamodb:Get*",
                "dynamodb:Query",
                "dynamodb:Scan"
            ],
            "Resource": "arn:aws:dynamodb:*:*:table/tt-subjects"
        }
    ]
}

But I still got the same error.

Does it take a long time to apply the policies or what may still cause that?

Answer 1

Now I found the answer. As I created my lambda with codestar, it also created a permission boundary.

How to solve this issue:

• remove the boundary (not recommended)
• extend the boundary, like this:

Edit the boundary of your lambda:

1. Open console for Lambda
2. Go to tab configuration
3. In Execution Role, open the link to your role
4. Now you are in IAM role editor. Scroll down to Permission boundary
5. Copy that name (there is no link)
6. Go in IAM menu to Policies
7. Search for the copied name
8. Edit (extend) the policy.

In my case regarding dynamodb, I scrolled down to sid 6 (might differ for you). It is an Allow block with many simple entries and a * as resource.

So I extended this block with dynamodb entries. Now it looks like this:

...
{
            "Sid": "6",
            "Effect": "Allow",
            "Action": [
                "apigateway:GET",
                "cloudtrail:CreateTrail",
                "cloudtrail:StartLogging",
                "ec2:Describe*",
                "lambda:ListFunctions",
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:DescribeLogGroups",
                "logs:PutLogEvents",
                "sns:Get*",
                "sns:List*",
                "sns:Publish",
                "sns:Subscribe",
                "xray:Put*",

                "dynamodb:BatchGet*",
                "dynamodb:DescribeStream",
                "dynamodb:DescribeTable",
                "dynamodb:Get*",
                "dynamodb:Query",
                "dynamodb:Scan",
                "dynamodb:BatchWrite*",
                "dynamodb:CreateTable",
                "dynamodb:Delete*",
                "dynamodb:Update*",
                "dynamodb:PutItem",

                "dynamodb:List*",
                "dynamodb:DescribeReservedCapacity*",
                "dynamodb:DescribeLimits",
                "dynamodb:DescribeTimeToLive"
            ],
            "Resource": [
                "*"
            ]
        },
...

Many thanks to the contributors helped me!