Timestream IAM Policy

0

I would like to create an IAM policy bound to an IAM role that allows Lambda permissions to the WriteRecords API scoped to an individual table. I am using the IAM policy below from the Timestream documentation but receive an 'access denied' for the WriteRecords API unless the resource is scoped to "*" which is not what I require. I have copied the ARN from the Timestream console to ensure there are no character errors, but this seems to make no difference. I would appreciate any assistance so that I can correctly scope the security of my solution.

My current policy follows this example:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "timestream:WriteRecords"
            ],
            "Resource": [
                "arn:aws:timestream:us-east-1:<account_id>:database/sampleDB/table/DevOps"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "timestream:DescribeEndpoints"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

https://docs.aws.amazon.com/timestream/latest/developerguide/security_iam_id-based-policy-examples.html

otl
질문됨 일 년 전429회 조회
2개 답변
0

In Timestream databases and tables can be used in the Resource element of IAM permissions. Some Timestream actions, such as those for creating resources, cannot be performed on a specific resource. In those cases, you must use the wildcard (*).

Please refer : https://docs.aws.amazon.com/timestream/latest/developerguide/security_iam_service-with-iam.html

profile pictureAWS
전문가
답변함 일 년 전
0

Thanks for the info. Can you explain why the policy above does not work? This is from the official Timestream docs but does not provide access to the Table. This seems either like a documentation and/or product bug.

otl
답변함 일 년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠