用户：arn:aws:iam::AN:user/root 无权执行：dynamodb:DescribeTable 资源：arn:aws:dynamodb:eu-west-1:AN:table/MyTable

Question

I have a serverless project. I declared the needed resources in my serverless.html like below:

The resources needed for the project:

resources:
  Resources:
    FileDownloadBucket:
      Type: "AWS::S3::Bucket"
      Properties:
        BucketName: ${file(./config/${self:provider.stage}.yml):file_download_bucket_name}
        LifecycleConfiguration:
          Rules:
            - Status: Enabled
              ExpirationInDays: 365
    DynamoDb:
      Type: "AWS::DynamoDB::Table"
      Properties:
        TableName: ${file(./config/${self:provider.stage}.yml):dynamotable_name}
        AttributeDefinitions:
          - AttributeName: uuid
            AttributeType: S
        KeySchema:
          - AttributeName: uuid
            KeyType: HASH
        ProvisionedThroughput:
          ReadCapacityUnits: 1
          WriteCapacityUnits: 1

The permissions required for the iam role for this project:

  iam:
    role:
      name: ${opt:stage, 'dev'}-role
      statements:
        - Effect: 'Allow'
          Action: 'secretsmanager:GetSecretValue'
          Resource:
            - ${file(./config/${self:provider.stage}.yml):project_secrets_arn}
        - Effect: 'Allow'
          Action:
            - "lambda:InvokeFunction"
            - "lambda:GetFunction"
          Resource:
            - "*"
        - Effect: 'Allow'
          Action:
            - "s3:GetObject"
            - "s3:PutObject"
            - "s3:ListBucket"
          Resource:
            - "arn:aws:s3:::${file(./config/${self:provider.stage}.yml):file_download_bucket_name}/*"
        - Effect: 'Allow'
          Action:
            - dynamodb:DescribeTable
            - dynamodb:Query
            - dynamodb:Scan
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:UpdateItem
            - dynamodb:DeleteItem
          Resource:
            - "arn:aws:dynamodb:::table/${file(./config/${self:provider.stage}.yml):dynamotable_name}"

I also have a ./config/prod.yml file holding the s3 bucket names & dybamodb table names:

project_secrets_arn: "[ARN for the secret]"
file_download_bucket_name: "file-download-bucket-asdjsdkfhsdfidf"
dynamotable_name: "MyTable"

However when I deploy this project I get the Resource handler returned message: "User: arn:aws:iam::[ACCOUNT_NUMBER]:user/root is not authorized to perform: dynamodb:DescribeTable on resource: arn:aws:dynamodb:eu-west-1:[ACCOUNT_NUMBER]:table/MyTable error. What am I doing wrong here?

ALSO, I tried using "Fn::GetAtt": as:

  Resource:
    - "Fn::GetAtt": [${self:provider.environment.MY_DB}, Arn]

and as:

  Resource:
    - "Fn::GetAtt": [MyTable, Arn]

to which I got the errors: Cannot parse "serverless.yml": missed comma between flow collection entries in "/home/runner/work/sc2/sc2/serverless.yml" (51:32) and The CloudFormation template is invalid: Template error: instance of Fn::GetAtt references undefined resource MY_DB respectively.

Answer 1

You need at allow for the role to be assumed by the RDS service, so you have to add a Trusted Policy to your role like the following,

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "rds.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

finally if you are behind a VPC make sure to add a rule to your VPCs SG that allows inbound connections from port 443(ie, HTTPS port) and as a source add your VPCs CIDR.