AWS DynamoDB permissions - getting error when user queries database - ios

Question

I am using Amazon Web Services to provide my users access my DynamoDB table. I am using Cognito for log in, and it seems to work. I have create the database and the policy to query my database. I have the code in the app, I have a user group, I have the database (write to it fine), I have the policy written. AWS is still giving me an access error.
Any idea where I am going wrong?

Answer 1

You need to go to the IAM console and attach appropriate policies for doing operations like getItem on your table. You need to attach a policy for the unauth / auth role created by Cognito Identity Pool. For a similar working app, you can use AWS Mobile Hub which will create policies for you and give a sample app which demonstrates using the queries on a table.
Thanks,
Rohan

Answer 2

Here's what I would recommend to do to fix the problem:
First in the Overview tab of your DynamoDB table, copy the Amazon Resource Name (ARN) it should look something like:
arn:aws:dynamodb:us-west-2:227509******:table/TableName
After that go to your IAM console and click on Roles off to the left. Once in the Roles section click on the UnAuth_Role for the app associated with your table. Should look like:
Cognito_AppNameUnauth_Role
Once here, click on Create Role Policy - then select Custom Policy - then click Select.
Create a name for your policy
Copy this code but edit it with your ARN:
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:Scan",
"dynamodb:Query",
],
"Resource": [
"arn:aws:dynamodb:us-west-2:227509******:table/TableName",
"arn:aws:dynamodb:us-west-2:227509******:table/TableName/index/*"
]
}
]
}
Add more permissions if you need to like :
"dynamodb:DeleteItem",
"dynamodb:PutItem",
"dynamodb:UpdateItem",
"dynamodb:BatchWriteItem"
I can't guarantee that will fix the problem. But it's a start in the right direction.

Answer 3

I've been struggling with the same issue. I have successfully authenticated via Cognito UserPool, verified policy was set up, ran into error code 6 as you did above. Found that if I changed user table permissions from "Private" to "Public", although not desirable, allowed me to read/write from table.
DynamoDB Table Permissions
The "Condition" clause below is added when you select "Private" instead of "Public" through the console. I can't find clear documentation on what this means / how to satisfy the condition it's asking for. (If someone understands better feel free to help edit this response!)
"Effect":"Allow",
"Action": [
"dynamodb:BatchGetItem",
"dynamodb:DescribeTable",
"dynamodb:GetItem",
"dynamodb:ListTables",
"dynamodb:Query"
],
"Resource": [
"arn:aws:dynamodb:...:table/...",
...
],
"Condition": {
"ForAllValues:StringEquals": {
"dynamodb:LeadingKeys": ["${cognito-identity.amazonaws.com:sub}"]
}
}