Write a least-privilege IAM policy for a Lambda + DynamoDB pair
Wann einsetzen: You're wiring a Lambda to a Dynamo table and don't want to give it * permissions.
Ablauf
-
State the access neededUse the aws iam + lambda skills. Write a policy for a Lambda that needs GetItem and UpdateItem on table Orders and nothing else.✓ Kopiert→ Policy with exact actions + resource ARN, no wildcards
-
TestGive me the
aws iam simulate-custom-policycommand to verify this allows only those two actions.✓ Kopiert→ Runnable command with correct syntax
Ergebnis: A production-quality least-privilege IAM policy with verification.
Fallstricke
- Policy uses wildcards for convenience — Insist on exact resource ARNs — skill supports this strongly