User is not authorized to perform: dynamodb:PutItem on resource

Question

I am trying to access DynamoDB from my Node app deployed on AWS ElasticBeanStalk. I am getting an error

User is not authorized to perform: dynamodb:PutItem on resource

It works perfectly fine locally, but when I deploy to the AWS it stops performing.

Answer 1

I am trying to access DynamoDB from my Node app deployed on AWS ElasticBeanStalk. I am getting an error

User is not authorized to perform: dynamodb:PutItem on resource

It works perfectly fine locally, but when I deploy to the AWS it stops performing.

Answer 2

I am trying to access DynamoDB from my Node app deployed on AWS ElasticBeanStalk. I am getting an error

User is not authorized to perform: dynamodb:PutItem on resource

It works perfectly fine locally, but when I deploy to the AWS it stops performing.

Answer 3

I am trying to access DynamoDB from my Node app deployed on AWS ElasticBeanStalk. I am getting an error

User is not authorized to perform: dynamodb:PutItem on resource

It works perfectly fine locally, but when I deploy to the AWS it stops performing.

Answer 4

Granting full dynamodb access using aws managed policy AmazonDynamoDBFullAccess is not recommended and is not a best practice. Try adding your table arn in the resource key in the policy in your role policy json.

"Resource": "arn:aws:dynamodb:<region>:<account_id>:table:/dynamodb_table_name"

Answer 5

Sign in to IAM > Roles, select the service name. Make sure the DynamoDB Resource is correct.

Answer 6

Answer already is given but this is the best practice to use policy for your AWS user or role.

To Get object only from particular Table

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "dynamodb:DescribeTable",
                "dynamodb:GetItem"
            ],
            "Resource": "arn:aws:dynamodb:us-west-2:<account_number>:table/dev-panels"
        }
    ]
}

To Verify

aws dynamodb describe-table --table-name dev-panels

To put Object

 {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "VisualEditor0",
                "Effect": "Allow",
                "Action": [
                    "dynamodb:DescribeTable",
                    "dynamodb:PutItem"
                ],
                "Resource": "arn:aws:dynamodb:us-west-2:<account_number>:table/dev-panels"
            }
        ]
    }

To Allow All action on one table.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllAPIActionsOnBooks",
            "Effect": "Allow",
            "Action": "dynamodb:*",
            "Resource": "arn:aws:dynamodb:us-west-2:123456789012:table/<youtable_name>"
        }
    ]
}

To verify role or user

aws dynamodb put-item --table-name dev-panels --item file://user.json --return-consumed-capacity TOTAL

user.json

    {
        "Name": {"S": "adiii"},
    }