AWS JS SDK,IAM和DynamoDB问题

Question

使用AWS JS SDK + DynamoDB时出现此错误:

AccessDeniedException:User:arn:aws:its :: [accnt id]:assume-role/dynamoIntroRole/web-identity无权执行:dynamodb:PutItem on resource:arn:aws:dynamodb:us-west-2:[ accnt id]:table/websiteTest

这是我用过的HTML/JS:

<title>Insert title here</title>
</head>
<body>
<button id="login">Login</button>
<div id="fb-root"></div>

<script type="text/javascript">
var fbUserId;
var dynamodb = null; 
var appId = '120636118298132'; //from facebook
var roleArn = 'arn:aws:iam::[my account id deleted]:role/dynamoIntroRole'; //from AWS IAM

window.fbAsyncInit = function() {
	FB.init({appId : appId});
	
	document.getElementById('login').onclick = function(){
		
	FB.login(function (response)  
	{
		if(response.authResponse)
		{
			AWS.config.credentials = new AWS.WebIdentityCredentials({ //WIF
				RoleArn: roleArn,
				ProviderId: 'graph.facebook.com',
				WebIdentityToken: response.authResponse.accessToken
			});
			
			var dynamodb = new AWS.DynamoDB({ region: 'us-west-2' });
			var docClient = new AWS.DynamoDB.DocumentClient({ service: dynamodb });
			console.log("You're now logged in.");
			var params = {
					TableName: 'websiteTest',
				    Item: {
				        itemID:'lkjljljlkjlkjlkjlkjlkj',
				        f2:'kjhkjhkjhkjhkjhkjhkjhkjhkjh'
				    } 
				};
				docClient.put(params, function(err, data){
				    if (err) console.log(err);
				    else console.log(data);
				});
		}
		else
			{
			console.log("Issue logging in");
			}
		
	}); //end fb login
	
		};
	};
	// Load the FB JS SDK asynchronously
	(function(d, s, id){
	   var js, fjs = d.getElementsByTagName(s)[0];
	   if (d.getElementById(id)) {return;}
	   js = d.createElement(s); js.id = id;
	   js.src = "//connect.facebook.net/en_US/all.js";
	   fjs.parentNode.insertBefore(js, fjs);
	 }(document, 'script', 'facebook-jssdk'));
</script>

</body>

以下是我附加到所使用角色的IAM策略:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:DeleteItem",
                "dynamodb:GetItem",
                "dynamodb:PutItem",
                "dynamodb:Query",
                "dynamodb:UpdateItem"
            ],
            "Resource": [
                "arn:aws:dynamodb:us-west-2:[my account deleted]:table/websiteTest"
            ],
            "Condition": {
                "ForAllValues:StringEquals": {
                    "dynamodb:LeadingKeys": [
                        "${graph.facebook.com:id}"
                    ]
                }
            }
        }
    ]
}

我错过了什么？

Answer 1

您遇到的问题与IAM策略中指定的条件有关.它目前指定了细粒度的访问控制.

"Condition": {
            "ForAllValues:StringEquals": {
                "dynamodb:LeadingKeys": [
                    "${graph.facebook.com:id}"
                ]
            }
        }

条件要求分区键与使用的Facebook ID匹配.如果您没有指定的分区键,则会抛出AccessDeniedException.

因此,您需要创建一个以Facebook ID作为分区键的表,或者从IAM策略中删除条件.另请注意,分区键必须是字符串才能使用细粒度的访问控制.

资源:

DynamoDB的细粒度访问控制

细粒度访问控制的示例策略