Add dynamo db access permission to lambda function in cdk

Question

I have a lambda function which write data to and read data from dynamo db.  I want to add resource based policy to lambda function. But I couldn't find any relevant method in the cdk. Though I found function.addPermission method, it provides permissions to other AWS services to invoke this lambda.

Accepted Answer

For this you can use the `add_role_to_policy` function:

```
from aws_cdk import aws_lambda as _lambda
from aws_cdk.aws_lambda_python import PythonFunction
from aws_cdk import aws_iam as iam

my_function = PythonFunction(
    #function logic
)
  
my_function.add_to_role_policy(iam.PolicyStatement(
    effect=iam.Effect.ALLOW,
    actions=[
        'dynamodb:GetItem',
    ],
    resources=[
        'TABLE_ARN',
    ],
))
```

The above policy uses Python and grants the Lambda `GetItem` permissions on the DynamoDB table which ARN you provide.

More info can be found [here](https://docs.aws.amazon.com/cdk/v2/guide/permissions.html)

Answer

In general, it is recommended to use the grant function rather than granting permission directly from the cdk.
for example,

```typescript
const lambdaFunc = new lambda.Function(....);
const ddbTable = new ddb.Table(...);

ddbTable.grantReadData(lambdaFunc);
ddbTable.grantReadWriteData(lambdaFunc);
```

Add dynamo db access permission to lambda function in cdk

관련 콘텐츠