DynamoDBAPI 권한 작업, 자원 및 조건 참조 - Amazon DynamoDB

문서의 영문과 번역 사이에 충돌이 있는 경우에는 영문 버전을 따릅니다. 번역 버전은 기계 번역을 사용하여 제공합니다.

DynamoDBAPI 권한 작업, 자원 및 조건 참조

액세스 제어을 설정하고 IAM 자격 증명에 연결할 수 있는 권한 정책(자격 증명 기반 정책)을 작성할 때 다음 을 참조로 사용할 수 있습니다. 표 목록 DynamoDB API 작업, 부여된 권한으로 수행할 수 있는 작업 및 권한 부여된 AWS 리소스가 각각 나열되어 있습니다. 정책의 Action 필드에서 작업을 지정하고, 정책의 Resource 필드에서 리소스 값을 지정합니다.

DynamoDB 정책에서 AWS 차원 조건 키를 사용하면 제반 조건을 표시할 수 있습니다. AWS 전체 키의 전체 목록은 다음을 참조하십시오. 사용 가능한 키 에서 IAM 사용 설명서.

AWS; 고유 조건 키 이외에 DynamoDB에는 조건에서 사용할 수 있는 고유의 특정 키가 있습니다. 자세한 정보는 IAM 정책 조건을 사용하여 세부적인 액세스 제어 구현 단원을 참조하십시오.

참고

작업을 지정하려면 dynamodb: 접두사 다음에 API 작업 이름을 사용합니다(예: dynamodb:CreateTable).

스크롤 막대를 사용하여 테이블의 나머지 부분을 확인합니다.

Amazon DynamoDB API 및 작업에 대한 필수 권한
DynamoDB API 작업 필요한 권한(API 작업) 리소스:
BatchGetItem dynamodb:BatchGetItem arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
BatchWriteItem dynamodb:BatchWriteItem arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*

ConditionCheckItem

dynamodb:ConditionCheckItem arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
CreateBackup dynamodb:CreateBackup arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
CreateGlobalTable dynamodb:CreateGlobalTable arn:aws:dynamodb::account-id:global-table/global-table-name

또는

arn:aws:dynamodb::account-id:global-table/*

그리고

arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
CreateTable dynamodb:CreateTable arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
DeleteBackup dynamodb:DeleteBackup arn:aws:dynamodb:region:account-id:table/table-name/backup/backup-name

또는

arn:aws:dynamodb:region:account-id:table/table-name/backup/*
DeleteItem dynamodb:DeleteItem arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
DeleteTable dynamodb:DeleteTable arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
DescribeBackup dynamodb:DescribeBackup arn:aws:dynamodb:region:account-id:table/table-name/backup/backup-name

또는

arn:aws:dynamodb:region:account-id:table/table-name/backup/*
DescribeContinuousBackups dynamodb:DescribeContinuousBackups arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
DescribeGlobalTable dynamodb:DescribeGlobalTable arn:aws:dynamodb::account-id:global-table/global-table-name

또는

arn:aws:dynamodb::account-id:global-table/*
DescribeGlobalTableSettings dynamodb:DescribeGlobalTableSettings arn:aws:dynamodb::account-id:global-table/global-table-name

또는

arn:aws:dynamodb::account-id:global-table/*
DescribeLimits dynamodb:DescribeLimits arn:aws:dynamodb:region:account-id:*
DescribeReservedCapacity dynamodb:DescribeReservedCapacity arn:aws:dynamodb:region:account-id:*
DescribeReservedCapacityOfferings dynamodb:DescribeReservedCapacityOfferings arn:aws:dynamodb:region:account-id:*
DescribeStream dynamodb:DescribeStream arn:aws:dynamodb:region:account-id:table/table-name/stream/stream-label

또는

arn:aws:dynamodb:region:account-id:table/table-name/stream/*
DescribeTable dynamodb:DescribeTable arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
DescribeTimeToLive dynamodb:DescribeTimeToLive arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
EnclosingOperation dynamodb:EnclosingOperation arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
GetItem dynamodb:GetItem arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
GetRecords dynamodb:GetRecords arn:aws:dynamodb:region:account-id:table/table-name/stream/stream-label

또는

arn:aws:dynamodb:region:account-id:table/table-name/stream/*
GetShardIterator dynamodb:GetShardIterator arn:aws:dynamodb:region:account-id:table/table-name/stream/stream-label

또는

arn:aws:dynamodb:region:account-id:table/table-name/stream/*
ListBackups dynamodb:ListBackups arn:aws:dynamodb:region:account-id:table/table-name/backup/backup-name

또는

arn:aws:dynamodb:region:account-id:table/table-name/backup/*
ListGlobalTables dynamodb:ListGlobalTables arn:aws:dynamodb::account-id:global-table/global-table-name

또는

arn:aws:dynamodb::account-id:global-table/*
ListStreams dynamodb:ListStreams arn:aws:dynamodb:region:account-id:table/table-name/stream/*

또는

arn:aws:dynamodb:region:account-id:table/*/stream/*
ListTables dynamodb:ListTables *
ListTagsOfResource dynamodb:ListTagsOfResource arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
PurchaseReservedCapacityOfferings dynamodb:PurchaseReservedCapacityOfferings arn:aws:dynamodb:region:account-id:*
PutItem dynamodb:PutItem arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
쿼리 dynamodb:Query

테이블 쿼리:

arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*

인덱스 쿼리:

arn:aws:dynamodb:region:account-id:table/table-name/index/index-name

또는

arn:aws:dynamodb:region:account-id:table/table-name/index/*
RestoreTableFromBackup dynamodb:RestoreTableFromBackup arn:aws:dynamodb:region:account-id:table/table-name/backup/backup-name

또는

arn:aws:dynamodb:region:account-id:table/table-name/backup/*

그리고

arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
RestoreTableToPointInTime dynamodb:RestoreTableToPointInTime arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
Scan dynamodb:Scan

테이블 스캔:

arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*

인덱스를 스캔하려면(기본 테이블을 스캔할 수 있는 권한도 있어야 함)

arn:aws:dynamodb:region:account-id:table/table-name/index/index-name

또는

arn:aws:dynamodb:region:account-id:table/table-name/index/*
TagResource() dynamodb:TagResource arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
UntagResource dynamodb:UntagResource arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
UpdateContinuousBackups dynamodb:UpdateContinuousBackups arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
UpdateGlobalTable dynamodb:UpdateGlobalTable arn:aws:dynamodb::account-id:global-table/global-table-name

또는

arn:aws:dynamodb::account-id:global-table/*

그리고

arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
UpdateGlobalTableSettings dynamodb:UpdateGlobalTableSettings arn:aws:dynamodb::account-id:global-table/global-table-name

또는

arn:aws:dynamodb::account-id:global-table/*

그리고

arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
UpdateItem dynamodb:UpdateItem arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
UpdateTable dynamodb:UpdateTable arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*
UpdateTimeToLive dynamodb:UpdateTimeToLive arn:aws:dynamodb:region:account-id:table/table-name

또는

arn:aws:dynamodb:region:account-id:table/*

관련 주제