Permissions on Global Secondary Index

Question

I am using sam to define a dynamodb table as such:

#DynamoTables
  DevicesTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: devices
      AttributeDefinitions:
        - 
          AttributeName: "id"
          AttributeType: "S"
        - 
          AttributeName: "customerId"
          AttributeType: "S"
      KeySchema:
        - 
          AttributeName: "id"
          KeyType: "HASH"
        -
          AttributeName: "customerId"
          KeyType: "RANGE"
      GlobalSecondaryIndexes: 
        - 
          IndexName: "customers"
          KeySchema: 
            - 
              AttributeName: "customerId"
              KeyType: "HASH"
          Projection: 
            ProjectionType: "ALL"   
          ProvisionedThroughput: 
            ReadCapacityUnits: "5"
            WriteCapacityUnits: "5"
      ProvisionedThroughput:
        ReadCapacityUnits: "5"
        WriteCapacityUnits: "5"

I am able to access the table using a lambda function with Properties: Policies: AmazonDynamoDBFullAccess defined in sam and defining the put params using the TableName: 'devices' in node. However, when I attempt to query the index by defining the query on an index as such:

params = {
  TableName: 'devices',
  IndexName: 'customers'
  // ...
}

I get an error stating the lambda function does not have permissions to access that index:

AccessDeniedException: User: User: arn:aws:sts:::assumed-role/CodeStarWorker-Lambda/awscodestar-lambda-DeviceFunction is not authorized to perform: dynamodb:Query on resource: TABLEURL/devices/index/customers

Anyone know a way I can grant this access or work around this to query the index?

UPDATE: I don't think the AmazonDynamoDBFullAccess policy is affecting things, when I removed it from the template.yml i was still able to put to the table and still unable to query on the index. Do I have to manually add roles?

Answer 1

Your lambda has access to TABLEURL/devices but not to TABLEURL/devices/index/customers.

Here is an examplefrom aws docs on how to do allow access to all indexes of a db.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AccessAllIndexesOnBooks",
            "Effect": "Allow",
            "Action": [
                "dynamodb:*"
            ],
            "Resource": [
                "arn:aws:dynamodb:us-west-2:123456789012:table/Books",
                "arn:aws:dynamodb:us-west-2:123456789012:table/Books/index/*"
            ]
        }
    ]
}