View a markdown version of this page

Troubleshooting common ABAC errors for DynamoDB Streams - Amazon DynamoDB
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Troubleshooting common ABAC errors for DynamoDB Streams

If you receive an AccessDeniedException or your tag-based conditions don't behave as expected after you enable ABAC for DynamoDB Streams, use this topic to diagnose and resolve the most common causes.

Service-specific condition keys aren't considered as valid condition keys. If you've used such keys in your policies, these keys result in an error. You must replace the service-specific condition keys with an appropriate condition key to implement ABAC for DynamoDB Streams.

For example, say that you've used the dynamodb:ResourceTag condition key in a policy that performs the GetRecords request on a stream. The request fails with an AccessDeniedException. The following example shows the erroneous policy with the dynamodb:ResourceTag condition key.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetRecords"
      ],
      "Resource": "arn:aws:dynamodb:*:*:table/*/stream/*",
      "Condition": {
        "StringEquals": {
          "dynamodb:ResourceTag/Team": "Analytics"
        }
      }
    }
  ]
}

To fix this issue, replace the dynamodb:ResourceTag condition key with aws:ResourceTag, as shown in the following example.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetRecords"
      ],
      "Resource": "arn:aws:dynamodb:*:*:table/*/stream/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/Team": "Analytics"
        }
      }
    }
  ]
}

If you recently enabled Streams ABAC, the change might not have propagated yet. Updating the status of Streams ABAC is an asynchronous operation. Wait a few minutes and retry your request.

After a parent table is deleted, the stream continues to exist for 24 hours before being removed. During this 24-hour window, you can manage stream tags using the CLI or SDK commands (tag-resource, untag-resource, and list-tags-of-resource) with the stream ARN. You can't use the console or CloudFormation to modify tags on a stream whose parent table no longer exists.

If you receive an error when attempting to tag through the console, use the CLI instead:

aws dynamodb tag-resource \
  --resource-arn arn:aws:dynamodb:us-east-1:123456789012:table/DeletedTable/stream/2024-01-01T00:00:00.000 \
  --tags Key=environment,Value=production

To verify existing tags on the stream with parent table deleted:

aws dynamodb list-tags-of-resource \
  --resource-arn arn:aws:dynamodb:us-east-1:123456789012:table/DeletedTable/stream/2024-01-01T00:00:00.000

If you receive a ResourceNotFoundException, the 24-hour retention period has expired and the stream no longer exists.

You can opt out of Streams ABAC yourself only if the following are true:

  • You used the self-service way of opting in through the DynamoDB console.

  • You're opting out within seven calendar days of opting in.

If Streams ABAC was enabled for your account through Support, you won't be able to opt out through the DynamoDB console. To opt out, contact Support.

CloudFormation deployments that create or update a table with a stream might fail if the IAM role is missing required permissions. Specifically, the role must have dynamodb:TagResource and dynamodb:UntagResource permissions for stream resources. This applies to both AWS::DynamoDB::Table and AWS::DynamoDB::GlobalTable resource types, and affects both explicit stream tags and inherited stack-level tags.

To resolve this, update your CloudFormation service role's IAM policy to include stream tagging permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:TagResource",
        "dynamodb:UntagResource"
      ],
      "Resource": [
        "arn:aws:dynamodb:*:*:table/*/stream/*"
      ]
    }
  ]
}