获取 AmazonDynamoDBException：用户：arn:aws:iam:USER 无权执行：dynamodb:ListTables

Question

我在尝试 DynamoDB 配置和连接时遇到 AmazonDynamoDBException。 配置代码如下：

@AllArgsConstructor
@Configuration
public class AWSDynamoDBConfig {

    private final String accessKey;
    private final String secretKey;
    private final String roleArn;

    public AWSDynamoDBConfig() throws IOException {
        Properties properties = readProperties("common", "aws.properties");
        accessKey = properties.getProperty("aws.accessKey");
        secretKey = properties.getProperty("aws.secretKey");
        roleArn = properties.getProperty("aws.roleArn");
    }

    public AssumeRoleRequest roleRequest() {
        return new AssumeRoleRequest().withRoleArn(roleArn);
    }

    @Bean
    public AmazonDynamoDB amazonDynamoDB() {
        return AmazonDynamoDBClientBuilder
                .standard()
                .withRegion(Regions.EU_WEST_1)
                .withCredentials(amazonAWSCredentialProvider())
                .build();
    }

    @Bean
    public AWSCredentials amazonAWSCredential() {
        return new BasicAWSCredentials(accessKey, secretKey);
    }

    @Bean
    public DynamoDBMapperConfig dynamoDBMapperConfig() {
        return DynamoDBMapperConfig.DEFAULT;
    }

    @Bean
    public DynamoDBMapper dynamoDBMapper(AmazonDynamoDB amazonDynamoDB, DynamoDBMapperConfig config) {
        return new DynamoDBMapper(amazonDynamoDB, config);
    }

    @Bean
    public DynamoDB dynamoDB() {
        return new DynamoDB(amazonDynamoDB());
    }

    public AWSCredentialsProvider amazonAWSCredentialProvider() {
        return new AWSStaticCredentialsProvider(amazonAWSCredential());
    }

}

在方法调用listTables时产生错误

public void listMyTables() {
        TableCollection<ListTablesResult> tables = awsDynamoDBConfig.dynamoDB().listTables();
        Iterator<Table> iterator = tables.iterator();

        log.info("Listing tables from DynamoDB instance");
        while (iterator.hasNext()) {
            Table table = iterator.next();
            log.info("Table name: " + table.getTableName());
        }
    }

com.amazonaws.services.dynamodbv2.model.AmazonDynamoDBException：用户：arn:aws:iam::number:user/machine-USER 无权执行：dynamodb:ListTables on resource:arn:aws:dynamodb:eu -west-1:number:table/*（服务：AmazonDynamoDBv2；状态代码：400；错误代码：AccessDeniedException；请求 ID：ID-Number）

据我所知，我在 AmazonDynamoDB 对象中缺少roleArn，这就是我想添加它的原因。 到目前为止，我找到了一个主题click，但上述解决方案使用了已弃用的对象AWSSecurityTokenServiceClient，毕竟，我会使用新的对象AmazonDynamoDB，但我没有找到如何使它成为现实。
对于如何将缺少的arnRole 添加到AmazonDynamoDB 对象以完成配置步骤并建立连接的建议，我将不胜感激。

Answer 1

您需要为运行此代码的角色设置 IAM 策略或内联策略。不确定它是 lambda 还是在容器中，或者其他什么，无论哪种方式，您的策略都需要看起来像这样：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:ListTables"
            ],
            "Resource": [
                "arn:aws:dynamodb:eu-west-1:number:table/*"
            ]
        }
    ]
}