CloudFormation部署的Lambda访问DynamoDB报AccessDenied错误求助

1. 核心错误原因 #

你配置的DynamoFullAccessPolicy存在语法缺陷，导致权限规则未被IAM正确解析生效，因此Lambda执行时触发了权限拒绝。

2. 具体错误点及修复方案 #

• 动作列表单引号不闭合：DynamoDBTableAccess下的所有Action条目除首个外，都缺少开头的单引号，比如dynamodb:BatchGetItem'需修正为'dynamodb:BatchGetItem'
• 动作拼写错误：条目dynamodb:UpdateIte为拼写错误，需修正为'dynamodb:UpdateItem'
• !Sub语法无效：你定义了占位参数tableName但未在ARN中实际使用，可直接简化资源定义的写法，无需额外参数列表
• 角色名冗余标记：LambdaExecutionRole的RoleName字段误加了Markdown加粗标记**，会导致实际生成的角色名和预期不符，需删除两侧星号直接写LambdaExecutionRole

3. 修复后的参考配置 #

DynamoFullAccessPolicy:
  Type: AWS::IAM::ManagedPolicy
  Properties:
    Description: dynamo full access policy
    PolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Effect: Allow
          Sid: "DynamoDBIndexAndStreamAccess"
          Action:
            - 'dynamodb:GetShardIterator'
            - 'dynamodb:Scan'
            - 'dynamodb:Query'
            - 'dynamodb:DescribeStream'
            - 'dynamodb:GetRecords'
            - 'dynamodb:ListStream'
          Resource:
            - !Sub "arn:aws:dynamodb:*:*:table/${TableName}/index/*"
            - !Sub "arn:aws:dynamodb:*:*:table/${TableName}/stream/*"
        - Effect: Allow
          Sid: "DynamoDBTableAccess"
          Action:
            - 'dynamodb:BatchGetItem'
            - 'dynamodb:BatchWriteItem'
            - 'dynamodb:ConditionCheckItem'
            - 'dynamodb:PutItem'
            - 'dynamodb:DescribeTable'
            - 'dynamodb:DeleteItem'
            - 'dynamodb:GetItem'
            - 'dynamodb:Scan'
            - 'dynamodb:Query'
            - 'dynamodb:UpdateItem'
          Resource:
           - !Sub "arn:aws:dynamodb:*:*:table/${TableName}"
        - Effect: Allow
          Sid: "DynamoDBDescribeLimitsAccess"
          Action: 'dynamodb:DescribeLimits'
          Resource:
           - !Sub "arn:aws:dynamodb:*:*:table/${TableName}"
           - !Sub "arn:aws:dynamodb:*:*:table/${TableName}/index/*"

4. 验证流程 #

修改配置后重新部署CloudFormation栈，到IAM控制台检查LambdaExecutionRole关联的DynamoFullAccessPolicy无语法错误提示后，再测试Lambda函数即可。

内容的提问来源于stack exchange，提问作者Elad Kariti