# ARN for Query on DynamoDB index not working

**URL:** <https://forum.serverless.com/t/arn-for-query-on-dynamodb-index-not-working/10936>\
**Category:** Serverless Framework\
**Tags:** aws, dynamodb\
**Created:** [March 30, 2020, 3:28pm UTC](https://forum.serverless.com/t/arn-for-query-on-dynamodb-index-not-working/10936 "2020-03-30T15:28:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![simonfrey](https://avatars.discourse-cdn.com/v4/letter/s/5e9695/32.png) [@simonfrey](https://forum.serverless.com/u/simonfrey)\
**Post date:** [March 30, 2020, 3:28pm UTC](https://forum.serverless.com/t/arn-for-query-on-dynamodb-index-not-working/10936/1 "2020-03-30T15:28:23Z")

</div>

I want to query an index in a DynamoDB table. When doing so I get the following error:

`User: arn:aws:sts::XXX:assumed-role/bifr-dev-us-east-1-lambdaRole/bifr-dev-login is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:XXX:table/customers/index/email_index`

After trying to fix it with the proposed configs in [https://stackoverflow.com/questions/51537795/accessdenied-on-dynamodb-gsi-index](https://stackoverflow.com/questions/51537795/accessdenied-on-dynamodb-gsi-index) and [AWS and DynamoDB permissions: "User is not authorized to access this resource"](http://forum.serverless.com/t/aws-and-dynamodb-permissions-user-is-not-authorized-to-access-this-resource/3446) I came to the follwoing config, that still does not work. The same error persist. Maybe someone could help me with solving this problem.

Table config:

```
resources: 
      Resources:
        customers: 
          Type: AWS::DynamoDB::Table
          Properties:
            TableName: customers
            AttributeDefinitions:
              - AttributeName: "id"
                AttributeType: S
              - AttributeName: "email"
                AttributeType: S
            KeySchema:
              - AttributeName: "id"
                KeyType: HASH
            BillingMode: PAY_PER_REQUEST
            GlobalSecondaryIndexes: 
            - IndexName: 'email_index'
              KeySchema:
              - AttributeName: 'email'
                KeyType: 'HASH'
              Projection: 
                ProjectionType: 'ALL'

```

IAM Role config:

```
iamRoleStatements:
- Effect: Allow
  Action:
    - dynamodb:GetItem
    - dynamodb:UpdateItem
    - dynamodb:PutItem
    - dynamodb:Scan
  Resource: "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/*"
- Effect: Allow
  Action:
    - dynamodb:Query
  Resource: "arn:aws:dynamodb:us-east-1:250781267785:table/customers/index/email_index"

```

NodeJS code for the query:

```
var res = await aws.QueryItems({
    TableName: tableName,

    IndexName: 'email_index',
    KeyConditionExpression: '#email = :email',
    ExpressionAttributeNames: {
        "#email": "email"
    },
    ExpressionAttributeValues: {
        ":email": email
    }
});
```

---

<div class="post-metadata">

**Author:** ![akashsingla](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/akashsingla/32/4718_2.png) [@akashsingla](https://forum.serverless.com/u/akashsingla)\
**Post date:** [November 17, 2020, 12:14am UTC](https://forum.serverless.com/t/arn-for-query-on-dynamodb-index-not-working/10936/2 "2020-11-17T00:14:15Z")

</div>

If your lambda is in a VPC (uses private Subnet) and DynamoDB is not in the same VPC,  
chances are you won’t be able to connect both unless you establish VPC Peering