当IAM设置为允许全部时，为什么AWS拒绝许可？

Question

I'm trying to run a script that creates tables in DynamoDB. The first table is created just fine but the 2nd table runs into a permission problem, which seems to be IAM related.

This is a python security tool that requires an initial setup and part of that is creating two DynamoDB tables. I'm able to create the first table just fine but run into issues with the 2nd table.

The user role has wide open AWS permissions so I don't see how this is an issue.

Python3.7.3 if the version is necessary.

Traceback (most recent call last):
  File "argos_config_setup.py", line 28, in check_account_table
    response = client.describe_table(TableName=argos_account_table)
  File "/Users/generic_user/.virtualenvs/myvenv/lib/python3.7/site-packages/botocore/client.py", line 357, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/Users/generic_user/.virtualenvs/myvenv/lib/python3.7/site-packages/botocore/client.py", line 661, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.errorfactory.ResourceNotFoundException: An error occurred (ResourceNotFoundException) when calling the DescribeTable operation: Requested resource not found: Table: argos_accounts not found

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "argos_config_setup.py", line 240, in <module>
    check_account_table()
  File "argos_config_setup.py", line 34, in check_account_table
    create_account_table(argos_account_table)
  File "argos_config_setup.py", line 103, in create_account_table
    for accounts_itr in account_iterator:
  File "/Users/generic_user/.virtualenvs/myvenv/lib/python3.7/site-packages/botocore/paginate.py", line 255, in __iter__
    response = self._make_request(current_kwargs)
  File "/Users/generic_user/.virtualenvs/myvenv/lib/python3.7/site-packages/botocore/paginate.py", line 332, in _make_request
    return self._method(**current_kwargs)
  File "/Users/generic_user/.virtualenvs/myvenv/lib/python3.7/site-packages/botocore/client.py", line 357, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/Users/generic_user/.virtualenvs/myvenv/lib/python3.7/site-packages/botocore/client.py", line 661, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.errorfactory.AccessDeniedException: An error occurred (AccessDeniedException) when calling the ListAccounts operation: You don't have permissions to access this resource.

AWS JSON POLICY

    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}

A 2nd dynamoDB table is supposed to be created.

Below is the create_account_table function

    org_client = boto3.client('organizations')
    paginator = org_client.get_paginator('list_accounts')
    account_iterator = paginator.paginate()
    accounts = []
    for accounts_itr in account_iterator:
        for account in accounts_itr['Accounts']:
            accounts.append({'id': account['Id'], 'name': account['Name'], 'email': account['Email'],
                             'environment': ''})
    dynamodb_client = boto3.client('dynamodb')
    dynamodb_client.create_table(
        AttributeDefinitions=[
            {
                "AttributeName": "id",
                "AttributeType": "S"
            }
        ],
        TableName=argos_account_table,
        KeySchema=[
            {
                "AttributeName": "id",
                "KeyType": "HASH"
            }
        ],
        BillingMode='PAY_PER_REQUEST'
    )

    dynamodb_resource = boto3.resource('dynamodb')
    table = dynamodb_resource.Table(argos_account_table)
    with table.batch_writer() as batch:
        for account in accounts:
            batch.put_item(
                Item={
                    'id': account['id'],
                    'name': account['name'],
                    'email': account['email'],
                    'environment': account['environment'],
                }
)

Answer 1

Without seeing how you are creating the tables I can only tell you two things:

The first error you encountered is because you are trying describe a table that can't be found (404 error)

While trying to handle the unfound table error it appears your code tried a ListAccounts call which depends on the AWS Organization settings you have. It appears your user doesn't have ListAccounts permission either.

Could you post a the snippet of how you are trying to create the tables, because here we can only see you make a describeTable call instead of a createTable.