View a markdown version of this page

Example 2: Allow tagging a stream using aws:RequestTag - Amazon DynamoDB
Using the Amazon CLIBehavior with and without Streams ABAC
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Example 2: Allow tagging a stream using aws:RequestTag

Using the aws:RequestTag/tag-key condition key, you can compare the tag key-value pair that's passed in your request with the tag pair specified in the IAM policy. For example, you can allow tagging a stream only if the request includes a specific tag.

Using the Amazon CLI

  1. Create an inline policy and add it to a role, as shown in the following example.

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:TagResource"
      ],
      "Resource": "arn:aws:dynamodb:*:*:table/*/stream/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CostCenter": "12345"
        }
      }
    }
  ]
}

  2. Tag the stream with the required tag key-value pair.

    aws dynamodb tag-resource \
  --resource-arn arn:aws:dynamodb:us-east-1:123456789012:table/myMusicTable/stream/2024-01-01T00:00:00.000 \
  --tags Key=CostCenter,Value=12345

Behavior with and without Streams ABAC

Without Streams ABAC

If Streams ABAC isn't enabled for your Amazon Web Services account, the tag conditions in the inline policy and the request aren't matched. The TagResource action returns an AccessDeniedException.

With Streams ABAC

If Streams ABAC is enabled for your Amazon Web Services account, the tag request completes successfully. Because the tag key-value pair of "CostCenter": "12345" is present in the TagResource request, the inline policy allows the action.