CognitoIdentityCredentials未被授權執行：dynamodb：查詢資源：

我一直在關注AWS文檔和DynamoDB使用的示例代碼，但在我的進展中已停止。在正確設置Cognito用戶池/標識和IAM角色後，我無法再查詢DynamoDB表。我能夠在沒有問題的情況下運行掃描，刪除和GetItem，但無法運行查詢。我的未經授權的IAM角色設置是否正確，以在我的DynamoDB表上運行查詢？CognitoIdentityCredentials未被授權執行：dynamodb：查詢資源：

IAM未經授權角色：

{ 
"Version": "2012-10-17", 
"Statement": [ 
    { 
     "Sid": "Stmt1474743569000", 
     "Effect": "Allow", 
     "Action": [ 
      "dynamodb:*" 
     ], 
     "Resource": [ 
      "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable1" 
     ] 
    }, 
    { 
     "Sid": "Stmt1474743616000", 
     "Effect": "Allow", 
     "Action": [ 
      "dynamodb:*" 
     ], 
     "Resource": [ 
      "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable2" 
     ] 
    } 
]

查詢功能：

func getQuery(){ 
    //performing a query 

    let dynamoDBObjectMapper = AWSDynamoDBObjectMapper.default() 

    let queryExpression = AWSDynamoDBQueryExpression() 
    //queryExpression.scanIndexForward = 1 
    queryExpression.indexName = "Pay" 

    queryExpression.keyConditionExpression = "Company = :Company AND Pay > :Pay" 

    queryExpression.expressionAttributeValues = [ 
     ":Company" : "TestCompany", 
     ":Pay" : 0]; 

    dynamoDBObjectMapper .query(DDBTableRow.self, expression: queryExpression) .continue(with: AWSExecutor.mainThread(), with: { (task:AWSTask!) -> AnyObject! in 
     if (task.error != nil) { 
      print("Error: \(task.error)") 

      let alertController = UIAlertController(title: "Failed to query a test table.", message: task.error!.localizedDescription, preferredStyle: UIAlertControllerStyle.alert) 
      let okAction = UIAlertAction(title: "OK", style: UIAlertActionStyle.cancel, handler: { (action:UIAlertAction) -> Void in 
      }) 
      alertController.addAction(okAction) 
      self.present(alertController, animated: true, completion: nil) 
     } else { 
      if (task.result != nil) { 
       self.pagniatedOutput = task.result! as AWSDynamoDBPaginatedOutput 
      } 
      //self.performSegue(withIdentifier: "unwindToMainSegue", sender: self) 
     } 
     return nil 
    }) 


}

預先感謝您的任何建議！

更新＃2：添加在異常收稿日期：

Error: Optional(Error Domain=com.amazonaws.AWSServiceErrorDomain Code=6 "(null)" 

    UserInfo={__type=com.amazon.coral.service#AccessDeniedException, 

    Message=User: arn:aws:sts::XXXXXXXXXX:assumed-role/Cognito_testUserUnauth_Role/CognitoIdentityCredentials is 
    not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable1/index/Pay})

更新＃3：的問題是，在我的IAM角色的資源參數。我做了一個小改動，現在可以查詢了。

{ 
"Version": "2012-10-17", 
"Statement": [ 
    { 
     "Sid": "Stmt1474743569000", 
     "Effect": "Allow", 
     "Action": [ 
      "dynamodb:*" 
     ], 
     "Resource": [ 
      "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable1", 
      "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable1/index/*" 
     ] 
    }, 
    { 
     "Sid": "Stmt1474743616000", 
     "Effect": "Allow", 
     "Action": [ 
      "dynamodb:*" 
     ], 
     "Resource": [ 
      "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable2", 
      "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable2/index/*" 
     ] 
    } 
]

來源

2016-09-24 Tyler Pereira

您的權限對我來說很好看。你可以分享確切的異常信息，你也可以驗證你想查詢哪個表？ –

@RachitDhall我正在查詢MyTable1。我已更新我的帖子，但我收到的例外情況已更新。謝謝！ –

@RachitDhall解決了我更新的帖子中所做更改的問題。感謝您的迴應！ –

更新＃3：問題是在我的IAM角色中的Resource參數。我做了一個小改動，現在可以查詢了。

{"Version": "2012-10-17","Statement": [ 
{ 
    "Sid": "Stmt1474743569000", 
    "Effect": "Allow", 
    "Action": [ 
     "dynamodb:*" 
    ], 
    "Resource": [ 
     "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable1", 
     "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable1/index/*" 
    ] 
}, 
{ 
    "Sid": "Stmt1474743616000", 
    "Effect": "Allow", 
    "Action": [ 
     "dynamodb:*" 
    ], 
    "Resource": [ 
     "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable2", 
     "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable2/index/*" 
    ] 
} 
]

來源

2016-12-03 20:22:04

CognitoIdentityCredentials未被授權執行：dynamodb：查詢資源：

回答

相關問題