DynamoDB not able to Restore With Deny DeleteItem SCP

0

Hi there,

We have a service control policy attached for our account with explicit Deny on Dynamodb Delete Item. We have enabled Point in Time Recovery for the tables as well. When I was trying to perform Restore on a table, It's throwing error saying "User ....... not authorized to perform: dynamodb:DeleteItem on resource .... with an explicit deny in a service control policy"

I would like to know why Restore table action requires DeleteItem action ? Is this right ? How do we handle this case without trading off the SCP policy ?

Thanks

1回答
2
承認された回答

DeleteItem is required as part of the IAM policy but it is never used. Unfortunately this is by design and to restore a table you will need to grant the restore process DeleteItem permissions.

My assumption here is that the permissions are required as restore to an existing table has been long talked about and perhaps DeleteItem permissions are required for that feature, if/when it becomes available.

profile pictureAWS
エキスパート
回答済み 1年前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ