Question

我的用户注册Facebook和桌面有基本的用户信息。我希望用户只更新，删除等自己的记录，但也能够 对所有其他用户的属性具有读取权限 。例如。看到他们的名字。如何创建允许此操作的策略？这适用于场景1：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "FullAccessToUserItems",
        "Effect": "Allow",
        "Action": [
            "dynamodb:GetItem",
            "dynamodb:BatchGetItem",
            "dynamodb:Query",
            "dynamodb:PutItem",
            "dynamodb:UpdateItem",
            "dynamodb:DeleteItem",
            "dynamodb:BatchWriteItem"
        ],
        "Resource": [
            "arn:aws:dynamodb:us-west-2:123456789012:table/Users"
        ],
        "Condition": {
            "ForAllValues:StringEquals": {
                "dynamodb:LeadingKeys": [
                      "${graph.facebook.com:id}"
                ]
            }
        }
    }
]

}

Answer 1

只需添加另一个对整个表具有读取权限的语句。

这样的事情应该有效：

{
    "Sid": "ReadAccess",
    "Effect": "Allow",
    "Action": [
        "dynamodb:GetItem",
        "dynamodb:BatchGetItem",
        "dynamodb:Query"
    ],
    "Resource": [
        "arn:aws:dynamodb:us-west-2:123456789012:table/Users"
    ]
}

整个政策都是这样的。请注意底部的第二个陈述：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "FullAccessToUserItems",
        "Effect": "Allow",
        "Action": [
            "dynamodb:GetItem",
            "dynamodb:BatchGetItem",
            "dynamodb:Query",
            "dynamodb:PutItem",
            "dynamodb:UpdateItem",
            "dynamodb:DeleteItem",
            "dynamodb:BatchWriteItem"
        ],
        "Resource": [
            "arn:aws:dynamodb:us-west-2:123456789012:table/Users"
        ],
        "Condition": {
            "ForAllValues:StringEquals": {
                "dynamodb:LeadingKeys": [
                      "${graph.facebook.com:id}"
                ]
            }
        }
    },
    {
        "Sid": "ReadAccess",
        "Effect": "Allow",
        "Action": [
            "dynamodb:GetItem",
            "dynamodb:BatchGetItem",
            "dynamodb:Query"
        ],
        "Resource": [
            "arn:aws:dynamodb:us-west-2:123456789012:table/Users"
        ]
    }
]
}

DynamoDb中的细粒度访问

1 个答案: