AmazonServiceException：未授权用户执行：dynamodb：DescribeTable状态代码：400;错误代码：AccessDeniedException

Question

我原本以为这个问题是由于区域不匹配造成的，但是在更改区域之后，我在尝试在此处找到的Amazon AWS样本时仍然会遇到以下错误：

DynamoDBMapper

 AmazonServiceException: User: arn:aws:sts::[My Account
 ARN]:assumed-role/Cognito_AndroidAppUnauth_DefaultRole/ProviderSession
 is not authorized to perform: dynamodb:DescribeTable on resource:
 arn:aws:dynamodb:us-east-1:[My Account ARN]:table/test_table (Service:
 AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException;
 Request ID: BBFTS0Q8UHTMG120IORC2KSASVVV4KQNSO5AEMVJF66Q9ASUAAJG)

所有内容都或多或少相同，我改变的唯一内容就是将DBclient区域更改为US_EAST_1，托管我的测试表并使用以下信息修改Constants文件通过遵循Cognito入门文档生成的“Amazon Cognito Starter Code”页面。

sdkforandroid-cognito-auth

对于我的Cognito_AndroidAppUnauth_DefaultRole角色策略，我修改了默认的移动分析和同步服务权限，还包括对所有表的所有操作的访问权限，无论是否存在：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CognitoPolicy",
            "Action": [
                "mobileanalytics:PutEvents",
                "cognito-sync:*"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "DynamoDBPolicy",
            "Effect": "Allow",
            "Action": [
                "dynamodb: *"
            ],
            "Resource": "*"
        }
    ]
}

那么为什么在使用正确的区域并且Unauth策略应允许表访问时它声称它没有权限？

编辑：在DynamoDB资源（创建表）上调用方法时的Stacktrace，它是否有用

   com.amazonaws.AmazonServiceException: User: arn:aws:sts::[My Account ARN]:assumed-role/Cognito_AndroidAppUnauth_DefaultRole/ProviderSession is not authorized to perform: dynamodb:CreateTable on resource: arn:aws:dynamodb:us-east-1:[My Account ARN]:table/test_table (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException; Request ID: SDELNSMLO10EV7CM2STC1R9RU3VV4KQNSO5AEMVJF66Q9ASUAAJG)
            at com.amazonaws.http.AmazonHttpClient.handleErrorResponse(Unknown Source)
            at com.amazonaws.http.AmazonHttpClient.executeHelper(Unknown Source)
            at com.amazonaws.http.AmazonHttpClient.execute(Unknown Source)
            at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.invoke(Unknown Source)
            at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.createTable(Unknown Source)
            at com.amazonaws.demo.userpreferencesom.DynamoDBManager.createTable(DynamoDBManager.java:72)
            at com.amazonaws.demo.userpreferencesom.UserPreferenceDemoActivity$DynamoDBManagerTask.doInBackground(UserPreferenceDemoActivity.java:99)
            at com.amazonaws.demo.userpreferencesom.UserPreferenceDemoActivity$DynamoDBManagerTask.doInBackground(UserPreferenceDemoActivity.java:85)
            at android.os.AsyncTask$2.call(AsyncTask.java:288)
            at java.util.concurrent.FutureTask.run(FutureTask.java:237)
            at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1112)
            at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:587)
            at java.lang.Thread.run(Thread.java:841)

Answer 1

与亚马逊工程师合作，事实证明问题出在政策配置中：

"dynamodb: *"

应该是

"dynamodb:*"

空间可以做到的很棒。

Answer 2

在我的情况下，我的表名包含一个“ /”字符，该字符无效。从表名称中删除“ /”字符即可解决此问题。

Answer 3

您可以像这样将权限分配给lambda角色：