# AWS and DynamoDB permissions: "User is not authorized to access this resource"

**URL:** <https://forum.serverless.com/t/aws-and-dynamodb-permissions-user-is-not-authorized-to-access-this-resource/3446>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [January 7, 2018, 6:23am UTC](https://forum.serverless.com/t/aws-and-dynamodb-permissions-user-is-not-authorized-to-access-this-resource/3446 "2018-01-07T06:23:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jorgt](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jorgt/32/955_2.png) [@jorgt](https://forum.serverless.com/u/jorgt)\
**Post date:** [January 7, 2018, 6:23am UTC](https://forum.serverless.com/t/aws-and-dynamodb-permissions-user-is-not-authorized-to-access-this-resource/3446/1 "2018-01-07T06:23:22Z")

</div>

Hi,

My setup includes an iam role statement to interact with DynamoDB:

```
  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - "ec2:CreateNetworkInterface"
        - "ec2:DescribeNetworkInterfaces"
        - "ec2:DeleteNetworkInterface"
      Resource: "*"
    - Effect: Allow
      Action:
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
      Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.DYNAMODB_DATA}"

```

And yet, here we are:

> AccessDeniedException: User: arn:aws:sts::947426108344:assumed-role/keyless-dev-ap-southeast-2-lambdaRole/keyless-dev-logsList is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:ap-southeast-2:947426108344:table/dev-keyless-data/index/type-created\_at-index

I expanded permissions on the serverless role to include any dynamodb action on any table for the sake of conversation. Now I’m receiving the message:

> “User is not authorized to access this resource”

With further header information:

> x-amzn-errortype:AccessDeniedException  
> x-amzn-requestid:ecd5cd60-f374-11e7-82e6-37d492e392d3  
> x-cache:Error from cloudfront

My setup includes a domain name using serverless-domain-manager plugin. It doesn’t seem to reach my authenticator functions as the cloud watch logs are empty.

This happens in 90% of the cases. Sometimes, it goes through. Right now it succeeds on my `/logs` endpoint but not on my `/users` endpoint, though setup is identical. On redeploy, `/logs` fails but `/users` succeeds.

I’m in over my head here. I can’t even find cloudfront logs.

---

<div class="post-metadata">

**Author:** ![bill](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bill/32/1072_2.png) [@bill](https://forum.serverless.com/u/bill)\
**Post date:** [January 8, 2018, 12:44am UTC](https://forum.serverless.com/t/aws-and-dynamodb-permissions-user-is-not-authorized-to-access-this-resource/3446/2 "2018-01-08T00:44:55Z")

</div>

For DynamoDB index, the resource path is different. So you need to add the index path as well in `iamRoleStatements`. For example:

**(By the way, I don’t think you need to GetItem/PutItem/UpdateItem/DeleteItem index. If this is the case, you can add these permissions back easily)**

```
 iamRoleStatements:
    - Effect: "Allow"
      Action:
        - "ec2:CreateNetworkInterface"
        - "ec2:DescribeNetworkInterfaces"
        - "ec2:DeleteNetworkInterface"
      Resource: "*"
    - Effect: Allow
      Action:
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
      Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.DYNAMODB_DATA}"
    - Effect: Allow
      Action:
        - dynamodb:Query
        - dynamodb:Scan
      Resource: "arn:aws:dynamodb:${self:provider.region}:*:table/${self:provider.environment.DYNAMODB_DATA}/index/*"

```

Please read this document for further understanding:

[https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/api-permissions-reference.html](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/api-permissions-reference.html)