可以在dynamodb的细粒度访问策略中使用通配符(*)吗?

时间:2017-10-06 11:47:11

标签: amazon-dynamodb amazon-iam

我有一个亚马逊dynamodb表,其分区键由用户的ID(来自facebook或google)和其他字符组成。我知道通配符可用于指定细粒度访问策略的属性,但我无法在dynamodb:LeadingKeys工作中获取通配符。

以下是工作政策:

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "dynamodb:BatchGetItem",
              "dynamodb:BatchWriteItem",
              "dynamodb:DeleteItem",
              "dynamodb:GetItem",
              "dynamodb:PutItem",
              "dynamodb:Query",
              "dynamodb:UpdateItem"
          ],
          "Resource": [
              "arn:aws:dynamodb:<region>:<...>:table/<table-name>"
          ],
          "Condition": {
              "ForAllValues:StringEquals": {
                  "dynamodb:LeadingKeys": [
                      "g_${accounts.google.com:sub}"
                  ]
              }
          }
      }
  ]
}

但是,这不起作用:

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "dynamodb:BatchGetItem",
              "dynamodb:BatchWriteItem",
              "dynamodb:DeleteItem",
              "dynamodb:GetItem",
              "dynamodb:PutItem",
              "dynamodb:Query",
              "dynamodb:UpdateItem"
          ],
          "Resource": [
              "arn:aws:dynamodb:<region>:<...>:table/<table-name>"
          ],
          "Condition": {
              "ForAllValues:StringEquals": {
                  "dynamodb:LeadingKeys": [
                      "*_${accounts.google.com:sub}"
                  ]
              }
          }
      }
  ]
}

1 个答案:

答案 0 :(得分:2)

我找到了解决方法。因此,不要使用ForAllValues:StringEquals,而是使用ForAllValues:StringLike

工作政策如下:

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "dynamodb:BatchGetItem",
              "dynamodb:BatchWriteItem",
              "dynamodb:DeleteItem",
              "dynamodb:GetItem",
              "dynamodb:PutItem",
              "dynamodb:Query",
              "dynamodb:UpdateItem"
          ],
          "Resource": [
              "arn:aws:dynamodb:<region>:<...>:table/<table-name>"
          ],
          "Condition": {
              "ForAllValues:StringLike": {
                  "dynamodb:LeadingKeys": [
                      "*_${accounts.google.com:sub}"
                  ]
              }
          }
      }
  ]
}

我花了一些时间来找到这个参考:http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#AccessPolicyLanguage_ConditionType