Timestream IAM Policy

0

I would like to create an IAM policy bound to an IAM role that allows Lambda permissions to the WriteRecords API scoped to an individual table. I am using the IAM policy below from the Timestream documentation but receive an 'access denied' for the WriteRecords API unless the resource is scoped to "*" which is not what I require. I have copied the ARN from the Timestream console to ensure there are no character errors, but this seems to make no difference. I would appreciate any assistance so that I can correctly scope the security of my solution.

My current policy follows this example:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "timestream:WriteRecords"
            ],
            "Resource": [
                "arn:aws:timestream:us-east-1:<account_id>:database/sampleDB/table/DevOps"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "timestream:DescribeEndpoints"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

https://docs.aws.amazon.com/timestream/latest/developerguide/security_iam_id-based-policy-examples.html

otl
asked a year ago396 views
2 Answers
0

In Timestream databases and tables can be used in the Resource element of IAM permissions. Some Timestream actions, such as those for creating resources, cannot be performed on a specific resource. In those cases, you must use the wildcard (*).

Please refer : https://docs.aws.amazon.com/timestream/latest/developerguide/security_iam_service-with-iam.html

profile pictureAWS
EXPERT
answered a year ago
0

Thanks for the info. Can you explain why the policy above does not work? This is from the official Timestream docs but does not provide access to the Table. This seems either like a documentation and/or product bug.

otl
answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions