# 示例 4：使用 CloudFormation 为流添加标签
<a name="streams-abac-example-4"></a>

您可以直接在 CloudFormation 模板中为 DynamoDB Streams 指定标签。流标签在标准表的 `StreamSpecification` 属性中定义，以及在全局表的 `ReplicaStreamSpecification` 属性中定义。

## AWS::DynamoDB::Table
<a name="streams-abac-example-4-table"></a>

```
Resources:
  MyTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: MyTable
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      BillingMode: PAY_PER_REQUEST
      Tags:
        - Key: TableEnv
          Value: Production
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES
        Tags:
          - Key: StreamEnv
            Value: Production
          - Key: StreamTeam
            Value: Payments
```

## AWS::DynamoDB::GlobalTable
<a name="streams-abac-example-4-global-table"></a>

```
Resources:
  MyGlobalTable:
    Type: AWS::DynamoDB::GlobalTable
    Properties:
      TableName: MyGlobalTable
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      BillingMode: PAY_PER_REQUEST
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES
      Replicas:
        - Region: us-east-1
          Tags:
            - Key: TableEnv
              Value: Production
          ReplicaStreamSpecification:
            Tags:
              - Key: StreamEnv
                Value: Production
              - Key: StreamTeam
                Value: Payments
        - Region: eu-west-1
          Tags:
            - Key: TableEnv
              Value: Production
          ReplicaStreamSpecification:
            Tags:
              - Key: StreamEnv
                Value: Production
              - Key: StreamTeam
                Value: Payments
```

除了显式流标签外，CloudFormation 还会将堆栈级别的标签传播到流。如果您的堆栈配置了标签，这些标签将自动应用于堆栈中的所有资源，包括流。

**重要**  
用于 CloudFormation 部署的 IAM 角色必须对流资源 (`arn:aws:dynamodb:*:*:table/*/stream/*`) 拥有 `dynamodb:TagResource` 和 `dynamodb:UntagResource` 权限，才能将标签应用于流。如果缺少这些权限，请参阅[为流添加标签时 CloudFormation 部署失败](abac-troubleshooting-streams.md#abac-troubleshooting-streams-cfn-tagging)以了解详细信息。