EC2 Instance profile to access DynamoDB - amazon-web-services

Question

I want to use ec2 instance profile to allow my python program to access a DynamoDb table. I have tested a policy by directly assigning to the user. Now I assign this same policy as a Instance Profile to ec2 instance where my job is running.
This is the policy.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:*"
],
"Resource": "arn:aws:dynamodb:us-east-2:913580688765:table/users"
}
]
}
Additionally I assigned a policy to the user to be able to Pass the ec2 role.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:AssociateIamInstanceProfile",
"ec2:ReplaceIamInstanceProfileAssociation"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ec2:DescribeIamInstanceProfileAssociations",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "*"
}
]
}
But this does not work.
What am I missing here?

Answer 1

I don't have the exact answer for you but I have advice on how you can progress. First off, lets recap (and can you please double check all this):
1) You have an EC2 instance running, it's assigned to an IAM role.
2) The IAM Role trust relationship contains ec2.amazonaws.com.
3) The policy granting "dynamodb:*" is attached to the role.
If this is done, that means everything should be configured properly.
At this point, i would suggest you ssh to the EC2 instance and test out the permissions. This can be done by using the AWS CLI's dynamodb API to make a list/describe/get API calls to confirm they work on the instance. If they works, it means the instance has permissions to access dynamodb and there might be something wrong with how you're using the instance profile.
It's worthy to note that not all operations are going to work on "arn:aws:dynamodb:us-east-2:913580688765:table/users" since it's a specific table rather than all the tables e.g. "arn:aws:dynamodb:us-east-2:913580688765:table/*". API calls such as list-tables won't work if the resource is a specific table. You can find a list of dynamodb api calls and weather or not they support a specific table or not in the documentation here.