DynamoDB not able to Restore With Deny DeleteItem SCP

0

Hi there,

We have a service control policy attached for our account with explicit Deny on Dynamodb Delete Item. We have enabled Point in Time Recovery for the tables as well. When I was trying to perform Restore on a table, It's throwing error saying "User ....... not authorized to perform: dynamodb:DeleteItem on resource .... with an explicit deny in a service control policy"

I would like to know why Restore table action requires DeleteItem action ? Is this right ? How do we handle this case without trading off the SCP policy ?

Thanks

asked a year ago230 views
1 Answer
2
Accepted Answer

DeleteItem is required as part of the IAM policy but it is never used. Unfortunately this is by design and to restore a table you will need to grant the restore process DeleteItem permissions.

My assumption here is that the permissions are required as restore to an existing table has been long talked about and perhaps DeleteItem permissions are required for that feature, if/when it becomes available.

profile pictureAWS
EXPERT
answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions