云开发工具包Dynamodb对lambda删除项的权限

Question

你好，我希望你能在这个问题上给我指引正确的方向。

我正在使用Amazon Web Services Cloud Development Kit。

我想创建一个Lambda函数来删除DynamoDB表中的项。

import * as lambda from '@aws-cdk/aws-lambda';
import * as iam from '@aws-cdk/aws-iam';

const deleteLambda = new lambda.Function(
    this,
    'deleteLambda',
    {
        functionName: 'deleteLambda',
        runtime: lambda.Runtime.NODEJS_10_X,
        handler: 'deleteLambda.handler',
        code: lambda.Code.fromAsset('lambdas-fns'),
        memorySize: 1024
    });

const lambdaARole = new iam.Role(this, 'LambdaRole', {
    assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
});

lambdaARole.addManagedPolicy(
    iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonDynamoDBFullAccess')
);

const tbl = new Table(this, 'TestTable', {})

现在我知道我可以使用tbl.grantReadData来允许lambda从表中读取项，或者使用tbl.grantWriteData来允许lambda添加项。但是我找不到允许删除项的正确语法。

如果有人能指出我遗漏了什么，我将不胜感激。

Answer 1

Granting permissions to resources

        const fn = new lambda.Function(this, 'Function', functionProps);
        const table = new dynamodb.Table(this, 'Table', tableProps);

        table.grant(fn, 'dynamodb:PutItem');

研讨会上还有另一个完整的cdk Allow Lambda to read/write our DynamoDB table示例。

        import * as cdk from '@aws-cdk/core';
        import * as lambda from '@aws-cdk/aws-lambda';
        import * as dynamodb from '@aws-cdk/aws-dynamodb';

        export interface HitCounterProps {
        /** the function for which we want to count url hits **/
        downstream: lambda.Function;
        }

        export class HitCounter extends cdk.Construct {

        /** allows accessing the counter function */
        public readonly handler: lambda.Function;

        constructor(scope: cdk.Construct, id: string, props: HitCounterProps) {
            super(scope, id);

            const table = new dynamodb.Table(this, 'Hits', {
                partitionKey: { name: 'path', type: dynamodb.AttributeType.STRING }
            });

            this.handler = new lambda.Function(this, 'HitCounterHandler', {
            runtime: lambda.Runtime.NODEJS_10_X,
            handler: 'hitcounter.handler',
            code: lambda.Code.fromAsset('lambda'),
            environment: {
                DOWNSTREAM_FUNCTION_NAME: props.downstream.functionName,
                HITS_TABLE_NAME: table.tableName
            }
            });

            // grant the lambda role read/write permissions to our table
            table.grantReadWriteData(this.handler);
        }
        }