Android AmazonServiceException：用户无权执行：dynamodb:DescribeTable 状态代码：400；错误代码：AccessDeniedException
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/24765256/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
AmazonServiceException: User is not authorized to perform: dynamodb:DescribeTable Status Code: 400; Error Code: AccessDeniedException
提问by Kurt Wagner
I had originally thought that this issue was due to mismatching regions, but after changing the region, I'm still coming across the following error when trying out an Amazon AWS sample found here:
我最初认为这个问题是由于区域不匹配造成的，但是在更改区域后，我在尝试此处找到的 Amazon AWS 示例时仍然遇到以下错误：
AmazonServiceException: User: arn:aws:sts::[My Account
ARN]:assumed-role/Cognito_AndroidAppUnauth_DefaultRole/ProviderSession
is not authorized to perform: dynamodb:DescribeTable on resource:
arn:aws:dynamodb:us-east-1:[My Account ARN]:table/test_table (Service:
AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException;
Request ID: BBFTS0Q8UHTMG120IORC2KSASVVV4KQNSO5AEMVJF66Q9ASUAAJG)
Everything is more or less the same, the only things I've changed have been changing the DBclientregion to US_EAST_1, where my test table is hosted and modifying the Constants file using the info from the 'Amazon Cognito Starter Code' page that is generated through following the Cognito get started documentation.
一切都或多或少相同，我唯一更改的内容是将DBclient区域更改为US_EAST_1，我的测试表托管在该区域并使用“Amazon Cognito Starter Code”页面中的信息修改常量文件，该页面通过以下方式生成Cognito 入门文档。
For my Cognito_AndroidAppUnauth_DefaultRolerole policy I modified the default mobile analytics and sync service permission to also include access of all actions on all tables, existing or not:
对于我的Cognito_AndroidAppUnauth_DefaultRole角色策略，我修改了默认的移动分析和同步服务权限，以包括对所有表（无论是否存在）的所有操作的访问权限：
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CognitoPolicy",
"Action": [
"mobileanalytics:PutEvents",
"cognito-sync:*"
],
"Effect": "Allow",
"Resource": [
"*"
]
},
{
"Sid": "DynamoDBPolicy",
"Effect": "Allow",
"Action": [
"dynamodb: *"
],
"Resource": "*"
}
]
}
So why is it claiming that it doesn't have permission when the correct region is used and the Unauth policy should allow for table access?
那么为什么它声称在使用正确的区域时它没有权限并且 Unauth 策略应该允许表访问？
EDIT: Stacktrace when calling a method on the DynamoDB resource (create table), should it prove useful
编辑：在 DynamoDB 资源（创建表）上调用方法时的 Stacktrace，是否证明有用
com.amazonaws.AmazonServiceException: User: arn:aws:sts::[My Account ARN]:assumed-role/Cognito_AndroidAppUnauth_DefaultRole/ProviderSession is not authorized to perform: dynamodb:CreateTable on resource: arn:aws:dynamodb:us-east-1:[My Account ARN]:table/test_table (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: AccessDeniedException; Request ID: SDELNSMLO10EV7CM2STC1R9RU3VV4KQNSO5AEMVJF66Q9ASUAAJG)
at com.amazonaws.http.AmazonHttpClient.handleErrorResponse(Unknown Source)
at com.amazonaws.http.AmazonHttpClient.executeHelper(Unknown Source)
at com.amazonaws.http.AmazonHttpClient.execute(Unknown Source)
at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.invoke(Unknown Source)
at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.createTable(Unknown Source)
at com.amazonaws.demo.userpreferencesom.DynamoDBManager.createTable(DynamoDBManager.java:72)
at com.amazonaws.demo.userpreferencesom.UserPreferenceDemoActivity$DynamoDBManagerTask.doInBackground(UserPreferenceDemoActivity.java:99)
at com.amazonaws.demo.userpreferencesom.UserPreferenceDemoActivity$DynamoDBManagerTask.doInBackground(UserPreferenceDemoActivity.java:85)
at android.os.AsyncTask.call(AsyncTask.java:288)
at java.util.concurrent.FutureTask.run(FutureTask.java:237)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1112)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:587)
at java.lang.Thread.run(Thread.java:841)
回答by Kurt Wagner
Worked with an Amazon engineer and it turns out the problem was in the policy configuration:
与亚马逊工程师合作，结果发现问题出在策略配置中：
"dynamodb: *"
should be
应该
"dynamodb:*"
It's amazing what a space can do.
一个空间可以做什么真是太神奇了。
回答by Clement
In my case, my table name included a "/" character, which is invalid. Removing the "/" character from the table name resolved the issue.
就我而言，我的表名包含一个“/”字符，这是无效的。从表名中删除“/”字符解决了该问题。
