Open julienrf opened 1 month ago
I tried changing the Lambda policy statement based on this:
Effect: Allow
Action:
- cloudwatch:GetMetricData
Resource:
- "*"
+Condition:
+ StringEquals:
+ "cloudwatch:namespace": "AWS/DynamoDB"
But when the lambda runs it fails with an Access Denied error.
This might be a known limitation of AWS, according to this.
Currently, the application requires the right to call
cloudwatch:GetMetricData
on any resource. Instead, we could constrain the policy to perform such calls only on theAWS/DynamoDB
resource namespace.