Add dynamo db access permission to lambda function in cdk

Question

I have a lambda function which write data to and read data from dynamo db.  I want to add resource based policy to lambda function. But I couldn't find any relevant method in the cdk. Though I found function.addPermission method, it provides permissions to other AWS services to invoke this lambda.

Accepted Answer

For this you can use the `add_role_to_policy` function:

```
from aws_cdk import aws_lambda as _lambda
from aws_cdk.aws_lambda_python import PythonFunction
from aws_cdk import aws_iam as iam

my_function = PythonFunction(
    #function logic
)
  
my_function.add_to_role_policy(iam.PolicyStatement(
    effect=iam.Effect.ALLOW,
    actions=[
        'dynamodb:GetItem',
    ],
    resources=[
        'TABLE_ARN',
    ],
))
```

The above policy uses Python and grants the Lambda `GetItem` permissions on the DynamoDB table which ARN you provide.

More info can be found [here](https://docs.aws.amazon.com/cdk/v2/guide/permissions.html)

Answer

In general, it is recommended to use the grant function rather than granting permission directly from the cdk.
for example,

```typescript
const lambdaFunc = new lambda.Function(....);
const ddbTable = new ddb.Table(...);

ddbTable.grantReadData(lambdaFunc);
ddbTable.grantReadWriteData(lambdaFunc);
```

Add dynamo db access permission to lambda function in cdk

Relevant questions

Can lambda know the specific attribute which changed in the dynamo db table update, when a lambda is triggered by dynamo db table update item??

Error connecting to Aurora PostgreSQL dB in .NET Core Lambda function.

How to add python libraries to lambda using the CDK?

How to export environment variables from a Lambda function.

Scheduling local lambda function

Deploy Lambda Function and API Gateway REST

Using AWS Lambda to run Python script, how can I save data?

403 creating java lambda function

Add dynamo db access permission to lambda function in cdk

Lambda to Dynamo Write: Intermittently missing batch data