# Error: is not authorized to perform: dynamodb:Query :(

**URL:** <https://discourse.sst.dev/t/error-is-not-authorized-to-perform-dynamodb-query/2023>\
**Category:** General\
**Created:** [August 13, 2020, 7:36pm UTC](https://discourse.sst.dev/t/error-is-not-authorized-to-perform-dynamodb-query/2023 "2020-08-13T19:36:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![roNn23](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/ronn23/32/957_2.png) [@roNn23](https://discourse.sst.dev/u/roNn23)\
**Post date:** [August 13, 2020, 7:36pm UTC](https://discourse.sst.dev/t/error-is-not-authorized-to-perform-dynamodb-query/2023/1 "2020-08-13T19:36:59Z")

</div>

Hey Folks, hope somebody can help me… I wanted to setup my AWS from scratch with the serverless.yml. It was working before (after completing this nice tutorial), so I decided to delete everything on AWS to start from scratch. Sadly, this is not working, because the authorization is failing:

```
User: arn:aws:sts::XXXXXX:assumed-role/notes-app-2-api-dev-eu-central-1-lambdaRole/notes-app-2-api-dev-list is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:eu-central-1:XXXXXXX:table/notes

```

Everything else is working… my serverless.yml:

```
# NOTE: update this with your service name
service: notes-app-2-api

# Create an optimized package for our functions
package:
  individually: true

plugins:
  - serverless-bundle # Package our functions with Webpack
  - serverless-offline
  - serverless-dotenv-plugin # Load .env as environment variables

custom:
  # Our stage is based on what is passed in when running serverless
  # commands. Or fallsback to what we have set in the provider section.
  stage: ${opt:stage, self:provider.stage}
  # Set the table name here so we can use it while testing locally
  tableName: ${self:custom.stage}-notes

provider:
  name: aws
  runtime: nodejs12.x
  stage: dev
  region: eu-central-1

  # These environment variables are made available to our functions
  # under process.env.
  environment:
    tableName: ${self:custom.tableName}

  # 'iamRoleStatements' defines the permission policy for the Lambda function.
  # In this case Lambda functions are granted with permissions to access DynamoDB.
  iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:DescribeTable
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
      # Restrict our IAM role permissions to
      # the specific table for the stage
      Resource:
        - "Fn::GetAtt": [NotesTable, Arn]

functions:
  # Defines an HTTP API endpoint that calls the main function in create.js
  # - path: url path is /notes
  # - method: POST request
  # - cors: enabled CORS (Cross-Origin Resource Sharing) for browser cross
  # domain api call
  # - authorizer: authenticate using the AWS IAM role
  create:
    handler: create.main
    events:
      - http:
          path: notes
          method: post
          cors: true
          authorizer: aws_iam

  get:
    # Defines an HTTP API endpoint that calls the main function in get.js
    # - path: url path is /notes/{id}
    # - method: GET request
    handler: get.main
    events:
      - http:
          path: notes/{id}
          method: get
          cors: true
          authorizer: aws_iam

  list:
    # Defines an HTTP API endpoint that calls the main function in list.js
    # - path: url path is /notes
    # - method: GET request
    handler: list.main
    events:
      - http:
          path: notes
          method: get
          cors: true
          authorizer: aws_iam

  update:
    # Defines an HTTP API endpoint that calls the main function in update.js
    # - path: url path is /notes/{id}
    # - method: PUT request
    handler: update.main
    events:
      - http:
          path: notes/{id}
          method: put
          cors: true
          authorizer: aws_iam

  delete:
    # Defines an HTTP API endpoint that calls the main function in delete.js
    # - path: url path is /notes/{id}
    # - method: DELETE request
    handler: delete.main
    events:
      - http:
          path: notes/{id}
          method: delete
          cors: true
          authorizer: aws_iam

# Create our resources with separate CloudFormation templates
resources:
  # API Gateway Errors
  - ${file(resources/api-gateway-errors.yml)}
  # DynamoDB
  - ${file(resources/dynamodb-table.yml)}
  # S3
  - ${file(resources/s3-bucket.yml)}
  # Cognito
  - ${file(resources/cognito-user-pool.yml)}
  - ${file(resources/cognito-identity-pool.yml)}

```

Thanks a lot!

---

<div class="post-metadata">

**Author:** ![roNn23](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/ronn23/32/957_2.png) [@roNn23](https://discourse.sst.dev/u/roNn23)\
**Post date:** [August 13, 2020, 7:43pm UTC](https://discourse.sst.dev/t/error-is-not-authorized-to-perform-dynamodb-query/2023/2 "2020-08-13T19:43:39Z")

</div>

I’m getting the same error, when testing the API over the CLI:

> **[Test the APIs](https://serverless-stack.com/chapters/test-the-apis.html)**
>
> To test a serverless backend API secured using IAM and Cognito User Pool you need to follow a few steps. First, generate a user token by authenticating with the User Pool. Then use the user token to get a set of temporary IAM credentials using the...

 ![Screenshot 2020-08-13 at 21.41.55](https://canada1.discourse-cdn.com/flex032/uploads/serverless_stack/original/1X/6d7a58991a8f5f55952ed4c05a2042e7b7a97e68.jpeg)

---

<div class="post-metadata">

**Author:** ![roNn23](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/ronn23/32/957_2.png) [@roNn23](https://discourse.sst.dev/u/roNn23)\
**Post date:** [August 13, 2020, 7:58pm UTC](https://discourse.sst.dev/t/error-is-not-authorized-to-perform-dynamodb-query/2023/3 "2020-08-13T19:58:30Z")

</div>

Okay, now I’ve just checked out the demo API and tried it. It is just not working, got the same error. So I think I have to do more, than just run `serverless deploy -v`? Please help, wasted a lot of time 😭

---

<div class="post-metadata">

**Author:** ![roNn23](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/ronn23/32/957_2.png) [@roNn23](https://discourse.sst.dev/u/roNn23)\
**Post date:** [August 17, 2020, 10:07am UTC](https://discourse.sst.dev/t/error-is-not-authorized-to-perform-dynamodb-query/2023/4 "2020-08-17T10:07:45Z")

</div>

No one has any ideas? 🤷‍♂️

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [August 24, 2020, 1:04am UTC](https://discourse.sst.dev/t/error-is-not-authorized-to-perform-dynamodb-query/2023/5 "2020-08-24T01:04:25Z")

</div>

This seems like an issue related to the Lambda not having the right permissions to make a call to DynamoDB:

> <https://github.com/AnomalyInnovations/serverless-stack-demo-api/blob/master/serverless.yml#L35>

One thing could be that the table you are querying in your Lambda functions isn’t the same as the one that you are granting permissions to in your `serverless.yml`.