dynamodb-users.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: Surf Advisor DynamoDB tables access users

Resources:

  DictionaryItemTableUser:
    Type: AWS::IAM::User
    Properties:
      Policies:
        - PolicyName: 'dictionaryDictItemTableAccess'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Sid: ListAndDescribe
              Effect: Allow
              Action:
                - dynamodb:List*
                - dynamodb:DescribeReservedCapacity*
                - dynamodb:DescribeLimits
                - dynamodb:DescribeTimeToLive
              Resource: "*"
            - Sid: SpecificTable
              Effect: Allow
              Action:
                - dynamodb:BatchGet*
                - dynamodb:DescribeStream
                - dynamodb:DescribeTable
                - dynamodb:Get*
                - dynamodb:Query
                - dynamodb:Scan
                - dynamodb:BatchWrite*
                - dynamodb:CreateTable
                - dynamodb:Delete*
                - dynamodb:Update*
                - dynamodb:PutItem
              Resource: arn:aws:dynamodb:*:*:table/DICT_ITEM

  GeolocationTableUser:
    Type: AWS::IAM::User
    Properties:
      Policies:
          - PolicyName: 'GeolocationTableAccess'
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Sid: ListAndDescribe
                  Effect: Allow
                  Action:
                    - dynamodb:List*
                    - dynamodb:DescribeReservedCapacity*
                    - dynamodb:DescribeLimits
                    - dynamodb:DescribeTimeToLive
                  Resource: "*"
                - Sid: SpecificTable
                  Effect: Allow
                  Action:
                    - dynamodb:BatchGet*
                    - dynamodb:DescribeStream
                    - dynamodb:DescribeTable
                    - dynamodb:Get*
                    - dynamodb:Query
                    - dynamodb:Scan
                    - dynamodb:BatchWrite*
                    - dynamodb:CreateTable
                    - dynamodb:Delete*
                    - dynamodb:Update*
                    - dynamodb:PutItem
                  Resource: arn:aws:dynamodb:*:*:table/GEOLOCATION
                - Sid: SpecificTableResources
                  Effect: Allow
                  Action:
                    - dynamodb:Query
                    - dynamodb:BatchGet*
                    - dynamodb:Get*
                  Resource: arn:aws:dynamodb:*:*:table/GEOLOCATION/*

  SpotTableUser:
    Type: AWS::IAM::User
    Properties:
      Policies:
        - PolicyName: 'SpotTableAccess'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: ListAndDescribe
                Effect: Allow
                Action:
                  - dynamodb:List*
                  - dynamodb:DescribeReservedCapacity*
                  - dynamodb:DescribeLimits
                  - dynamodb:DescribeTimeToLive
                Resource: "*"
              - Sid: SpecificTable
                Effect: Allow
                Action:
                  - dynamodb:BatchGet*
                  - dynamodb:DescribeStream
                  - dynamodb:DescribeTable
                  - dynamodb:Get*
                  - dynamodb:Query
                  - dynamodb:Scan
                  - dynamodb:BatchWrite*
                  - dynamodb:CreateTable
                  - dynamodb:Delete*
                  - dynamodb:Update*
                  - dynamodb:PutItem
                Resource: arn:aws:dynamodb:*:*:table/SPOT
              - Sid: SpecificTableResources
                Effect: Allow
                Action:
                  - dynamodb:Query
                  - dynamodb:BatchGet*
                  - dynamodb:Get*
                Resource: arn:aws:dynamodb:*:*:table/SPOT/*

  DictionaryItemTableUserKeys:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref DictionaryItemTableUser

  GeolocationTableUserKeys:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref GeolocationTableUser

  SpotTableUserKeys:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref SpotTableUser


Outputs:
  AccessKey:
    Value: !Ref DictionaryItemTableUserKeys
    Description: AWSAccessKeyId of new user
  SecretKey:
    Value: !GetAtt [DictionaryItemTableUserKeys, SecretAccessKey]
    Description: AWSSecretAccessKey of new user
  GeolocationAccessKey:
    Value: !Ref GeolocationTableUserKeys
    Description: AWSAccessKeyId of Geolocation table user
  GeolocationSecretKey:
    Value: !GetAtt [GeolocationTableUserKeys, SecretAccessKey]
    Description: AWSSecretAccessKey of Geolocation table user
  SpotAccessKey:
    Value: !Ref SpotTableUserKeys
    Description: AWSAccessKeyId of Spot table user
  SpotSecretKey:
    Value: !GetAtt [SpotTableUserKeys, SecretAccessKey]
    Description: AWSSecretAccessKey of Spot table user