Amazon DynamoDB＆IAM – 允许update-item更改单个属性

huangapple
go评论110阅读模式
英文:

Amazon DynamoDB & IAM - Allow update-item to change a single attribute

问题

描述:

我有一个包含50个项目的表格，每个项目至少有三个属性Name、Age和E-mail。

用户应该能够：

  1. 对特定项目的Name执行update。

  2. 对所有项目的属性执行以下操作：

  • BatchGetItem
  • ConditionCheckItem
  • DescribeTable
  • GetItem
  • Scan
  • ListTagsOfResource
  • Query

我尝试过的:

我在IAM中使用了这个策略：

  1. {
  2.     "Version": "2012-10-17",
  3.     "Statement": [
  4.         {
  5.             "Sid": "UserNameUpdate",
  6.             "Effect": "Allow",
  7.             "Action": "dynamodb:UpdateItem",
  8.             "Resource": "arn:aws:dynamodb:<region>:<account>:table/<tableName>",
  9.             "Condition": {
  10.                 "StringEquals": {
  11.                     "dynamodb:ReturnValues": [
  12.                         "NONE",
  13.                         "UPDATED_OLD",
  14.                         "UPDATED_NEW"
  15.                     ]
  16.                 },
  17.                 "ForAllValues:StringLike": {
  18.                     "dynamodb:Attributes": "Name"
  19.                 }
  20.             }
  21.         },
  22.         {
  23.             "Sid": "GetAll",
  24.             "Effect": "Allow",
  25.             "Action": [
  26.                 "dynamodb:BatchGetItem",
  27.                 "dynamodb:ConditionCheckItem",
  28.                 "dynamodb:DescribeTable",
  29.                 "dynamodb:GetItem",
  30.                 "dynamodb:Scan",
  31.                 "dynamodb:ListTagsOfResource",
  32.                 "dynamodb:Query"
  33.             ],
  34.             "Resource": "arn:aws:dynamodb:<region>:<account>:table/<tableName>"
  35.         }
  36.     ]
  37. }

结果:

  • 尝试更新项目时，我收到了AccessDeniedException。
  • 尝试其他操作时，它们正常工作。

我对IAM规则不是很了解，尤其是Condition部分 😓。任何帮助都将不胜感激。

英文:

Description:

I have a table with 50 items, each item has at least three attributes Name, Age and E-mail.

The user should be able to:

  1. Perform update on a specific item's Name.

  2. Perform these operations on all items' attributes:

  • BatchGetItem
  • ConditionCheckItem
  • DescribeTable
  • GetItem
  • Scan
  • ListTagsOfResource
  • Query

What I've Tried:

I used this policy in IAM:

  1. {
  2.     &quot;Version&quot;: &quot;2012-10-17&quot;,
  3.     &quot;Statement&quot;: [
  4.         {
  5.             &quot;Sid&quot;: &quot;UserNameUpdate&quot;,
  6.             &quot;Effect&quot;: &quot;Allow&quot;,
  7.             &quot;Action&quot;: &quot;dynamodb:UpdateItem&quot;,
  8.             &quot;Resource&quot;: &quot;arn:aws:dynamodb:&lt;region&gt;:&lt;account&gt;:table/&lt;tableName&gt;&quot;,
  9.             &quot;Condition&quot;: {
  10.                 &quot;StringEquals&quot;: {
  11.                     &quot;dynamodb:ReturnValues&quot;: [
  12.                         &quot;NONE&quot;,
  13.                         &quot;UPDATED_OLD&quot;,
  14.                         &quot;UPDATED_NEW&quot;
  15.                     ]
  16.                 },
  17.                 &quot;ForAllValues:StringLike&quot;: {
  18.                     &quot;dynamodb:Attributes&quot;: &quot;Name&quot;
  19.                 }
  20.             }
  21.         },
  22.         {
  23.             &quot;Sid&quot;: &quot;GetAll&quot;,
  24.             &quot;Effect&quot;: &quot;Allow&quot;,
  25.             &quot;Action&quot;: [
  26.                 &quot;dynamodb:BatchGetItem&quot;,
  27.                 &quot;dynamodb:ConditionCheckItem&quot;,
  28.                 &quot;dynamodb:DescribeTable&quot;,
  29.                 &quot;dynamodb:GetItem&quot;,
  30.                 &quot;dynamodb:Scan&quot;,
  31.                 &quot;dynamodb:ListTagsOfResource&quot;,
  32.                 &quot;dynamodb:Query&quot;
  33.             ],
  34.             &quot;Resource&quot;: &quot;arn:aws:dynamodb:&lt;region&gt;:&lt;account&gt;:table/&lt;tableName&gt;&quot;
  35.         }
  36.     ]
  37. }

The Result:

  • When trying to update-item I get AccessDeniedException.
  • When trying to other operations they work normally.

I'm not very much into IAM rules, especially Condition section 😕. Any help will be appreciated.

答案1

得分: 1

Name 是 DynamoDB 中的一个保留字。也许这就是你的问题所在？

英文:

Name is a reserved word in DynamoDB. Perhaps that's your problem?

答案2

得分: 1

我认为预期的是一个值数组：

  1. "ForAllValues:StringLike": {
  2.     "dynamodb:Attributes": ["Name"]
  3. }
英文:

I think an array of values is expected:

  1. &quot;ForAllValues:StringLike&quot;: {
  2.     &quot;dynamodb:Attributes&quot;: [&quot;Name&quot;]
  3. }

huangapple
  • 本文由 发表于 2020年9月25日 01:06:31
  • 转载请务必保留本文链接：https://go.coder-hub.com/64051173.html
  • amazon-dynamodb
  • amazon-iam
  • android
  • java
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定