Rollenrichtlinie für den Zugriff auf ein separates ARN-Ressourcenproblem

Question

Ich möchte eine Richtlinie hinzufügen, die den Zugriff auf IAM-Benutzer nur für einige wenige Tabellen erlaubt.

Folgen this document

Meine Politik:

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Action": [ 
       "cloudwatch:DescribeAlarmHistory", 
       "cloudwatch:DescribeAlarms", 
       "cloudwatch:DescribeAlarmsForMetric", 
       "cloudwatch:GetMetricStatistics", 
       "cloudwatch:ListMetrics", 
       "datapipeline:DescribeObjects", 
       "datapipeline:DescribePipelines", 
       "datapipeline:GetPipelineDefinition", 
       "datapipeline:ListPipelines", 
       "datapipeline:QueryObjects", 
       "dynamodb:BatchGetItem", 
       "dynamodb:DescribeTable", 
       "dynamodb:GetItem", 
       "dynamodb:ListTables", 
       "dynamodb:Query", 
       "dynamodb:Scan", 
       "dynamodb:DescribeReservedCapacity", 
       "dynamodb:DescribeReservedCapacityOfferings", 
       "sns:ListSubscriptionsByTopic", 
       "sns:ListTopics", 
       "lambda:ListFunctions", 
       "lambda:ListEventSourceMappings", 
       "lambda:GetFunctionConfiguration" 
      ], 
      "Effect": "Allow", 
      "Resource": [ 
       "arn:aws:dynamodb:eu-west-1: xxxxxxxxxxxx:table:table/<TableName>", //commented real name 
       "arn:aws:dynamodb:eu-west-1:xxxxxxxxxxxx:table/<TableName>" //commented real name 
      ] 
     } 
    ] 
} 

Als Ergebnis habe ich "Not autorized" -Meldung

Aber wenn ich Ressource ändern "*" - alle Werke .

Warum kann ich vollen Lesezugriff nicht nur auf separate Tabellen aktivieren?

Answer 1

Die Lösung dank Deepesh S. (von Amazon), unten aufgeführten

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Sid": "ResourceBasedActions", 
      "Action": [ 
       "datapipeline:DescribeObjects", 
       "datapipeline:DescribePipelines", 
       "datapipeline:GetPipelineDefinition", 
       "datapipeline:QueryObjects", 
       "dynamodb:BatchGetItem", 
       "dynamodb:DescribeTable", 
       "dynamodb:GetItem", 
       "dynamodb:Query", 
       "dynamodb:Scan", 
       "lambda:GetFunctionConfiguration" 
      ], 
      "Effect": "Allow", 
      "Resource": [ 
       "arn:aws:dynamodb:eu-west-1: xxxxxxxxxxxx:table:table/<TableName>", 
       "arn:aws:dynamodb:eu-west-1:xxxxxxxxxxxx:table/<TableName>" 
      ] 
     }, 
     { 
      "Sid": "NonResourceBasedActions", 
      "Action": [ 
       "cloudwatch:DescribeAlarmHistory", 
       "cloudwatch:DescribeAlarms", 
       "cloudwatch:DescribeAlarmsForMetric", 
       "cloudwatch:GetMetricStatistics", 
       "cloudwatch:ListMetrics", 
       "datapipeline:ListPipelines", 
       "dynamodb:ListTables", 
       "sns:ListSubscriptionsByTopic", 
       "sns:ListTopics", 
       "lambda:ListFunctions", 
       "lambda:ListEventSourceMappings", 
       "dynamodb:DescribeReservedCapacity", 
       "dynamodb:DescribeReservedCapacityOfferings" 
      ], 
      "Effect": "Allow", 
      "Resource": [ 
       "*" 
      ] 
     } 
    ] 
}