Skip to content

Commit 8c9c41a

Browse files
jwhartleyjwhartley
committed
Improve DynamoDB IAM documentation
- Remove trailing slashes from OIDC URLs in AWS IAM auth guide - Add IAM policy example for scoping to specific tables - Add Terraform example with circular dependency workaround - Add troubleshooting section for common IAM/OIDC issues
1 parent 0b82c41 commit 8c9c41a

File tree

2 files changed

+110
-5
lines changed

2 files changed

+110
-5
lines changed

‎site/docs/guides/iam-auth/aws.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,16 @@ To find the correct issuer value:
2323

2424
3. Find the **Data Planes** table and make sure you're viewing the correct tab for your data plane (either **public** or **private**).
2525

26-
4. Copy the value from the **IAM OIDC** column. This should look something like: `https://openid.estuary.dev/your-data-plane-identifier.dp.estuary-data.com/`
26+
4. Copy the value from the **IAM OIDC** column. This should look something like: `https://openid.estuary.dev/your-data-plane-identifier.dp.estuary-data.com`
2727

2828
For example, these are the issuer values for a few common public data planes:
2929

3030
| Data Plane | Issuer |
3131
|---|---|
32-
| US east-1 AWS data plane | https://openid.estuary.dev/aws-us-east-1-c1.dp.estuary-data.com/ |
33-
| US central-1 GCP data plane | https://openid.estuary.dev/gcp-us-central1-c2.dp.estuary-data.com/ |
34-
| US west-2 AWS data plane | https://openid.estuary.dev/aws-us-west-2-c1.dp.estuary-data.com/ |
35-
| EU west-1 AWS data plane | https://openid.estuary.dev/aws-eu-west-1-c1.dp.estuary-data.com/ |
32+
| US east-1 AWS data plane | https://openid.estuary.dev/aws-us-east-1-c1.dp.estuary-data.com |
33+
| US central-1 GCP data plane | https://openid.estuary.dev/gcp-us-central1-c2.dp.estuary-data.com |
34+
| US west-2 AWS data plane | https://openid.estuary.dev/aws-us-west-2-c1.dp.estuary-data.com |
35+
| EU west-1 AWS data plane | https://openid.estuary.dev/aws-eu-west-1-c1.dp.estuary-data.com |
3636

3737
![Add Identity Provider](../guide-images/aws-iam-1.png)
3838

‎site/docs/reference/Connectors/capture-connectors/amazon-dynamodb.md‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,85 @@ To use this connector, you'll need:
5252
}
5353
```
5454

55+
**Example IAM Policy for Specific Tables:**
56+
57+
If you want to limit access to specific tables rather than all tables, use this policy. Note that `ListTables` and `DescribeTable` require the `table/*` resource pattern and cannot be scoped to specific tables.
58+
59+
```json
60+
{
61+
"Version": "2012-10-17",
62+
"Statement": [
63+
{
64+
"Sid": "SpecificTableAccess",
65+
"Effect": "Allow",
66+
"Action": [
67+
"dynamodb:DescribeStream",
68+
"dynamodb:GetShardIterator",
69+
"dynamodb:GetRecords",
70+
"dynamodb:Scan"
71+
],
72+
"Resource": [
73+
"arn:aws:dynamodb:<REGION>:<ACCOUNT_ID>:table/<TABLE_NAME>",
74+
"arn:aws:dynamodb:<REGION>:<ACCOUNT_ID>:table/<TABLE_NAME>/stream/*"
75+
]
76+
},
77+
{
78+
"Sid": "DiscoveryAccess",
79+
"Effect": "Allow",
80+
"Action": [
81+
"dynamodb:ListTables",
82+
"dynamodb:DescribeTable"
83+
],
84+
"Resource": "arn:aws:dynamodb:<REGION>:<ACCOUNT_ID>:table/*"
85+
}
86+
]
87+
}
88+
```
89+
90+
**Terraform Example with IAM Role:**
91+
92+
When using Terraform to create both the OIDC provider and IAM role, you may encounter a circular dependency since the OIDC provider needs the role ARN as its audience, but the role needs the OIDC provider ARN in its trust policy. Use `locals` to construct the role ARN before creating it:
93+
94+
```hcl
95+
data "aws_caller_identity" "current" {}
96+
97+
locals {
98+
role_name = "EstuaryDynamoDB"
99+
role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${local.role_name}"
100+
}
101+
102+
resource "aws_iam_openid_connect_provider" "estuary" {
103+
url = "https://openid.estuary.dev/1234567890abcdef.dp.estuary-data.com"
104+
client_id_list = [local.role_arn]
105+
thumbprint_list = ["<THUMBPRINT>"]
106+
}
107+
108+
resource "aws_iam_role" "estuary_dynamodb" {
109+
name = local.role_name
110+
111+
assume_role_policy = jsonencode({
112+
Version = "2012-10-17"
113+
Statement = [{
114+
Effect = "Allow"
115+
Principal = {
116+
Federated = aws_iam_openid_connect_provider.estuary.arn
117+
}
118+
Action = "sts:AssumeRoleWithWebIdentity"
119+
Condition = {
120+
StringEquals = {
121+
"openid.estuary.dev/1234567890abcdef.dp.estuary-data.com:aud" = local.role_arn
122+
}
123+
StringLike = {
124+
"openid.estuary.dev/1234567890abcdef.dp.estuary-data.com:sub" = "your-tenant/*"
125+
}
126+
}
127+
}]
128+
})
129+
}
130+
```
131+
132+
Replace `1234567890abcdef.dp.estuary-data.com` with your data plane identifier from the Estuary dashboard.
133+
55134
- AWS Credentials. One of the following types:
56135
- The AWS **access key** and **secret access key** for the user. See the [AWS blog](https://aws.amazon.com/blogs/security/wheres-my-secret-access-key/) for help finding these credentials.
57136
- To authenticate using an AWS Role, you'll need the **region** and the **role arn**. Follow the steps in the [AWS IAM guide](/guides/iam-auth/aws.md) to setup the role.
@@ -121,3 +200,29 @@ captures:
121200
Your capture definition may be more complex, with additional bindings for each DynamoDB table.
122201
123202
[Learn more about capture definitions.](../../../concepts/captures.md#specification)
203+
204+
## Troubleshooting
205+
206+
### "No OpenIDConnect provider found"
207+
208+
The OIDC provider URL doesn't match what AWS expects. Verify:
209+
- The URL in AWS matches exactly what's shown in the Estuary connector config
210+
- Check for trailing slash mismatches (the URL should not have a trailing slash)
211+
212+
### "Not authorized to perform sts:AssumeRoleWithWebIdentity"
213+
214+
The trust policy conditions don't match. Verify:
215+
- The `aud` claim matches your role ARN exactly
216+
- The `sub` claim pattern matches your Estuary tenant prefix
217+
- Wait 1-2 minutes after creating or updating the OIDC provider for AWS propagation
218+
219+
### Tables not appearing in bindings
220+
221+
If your DynamoDB tables don't appear when configuring the capture:
222+
- Verify DynamoDB Streams is enabled on the table
223+
- Verify the stream view type is set to "New and old images"
224+
- Verify your IAM policy includes `ListTables` permission on `table/*`
225+
226+
### "dynamodb:ListTables... AccessDeniedException"
227+
228+
The `ListTables` action requires the `table/*` resource pattern. You cannot scope this permission to specific table names—it must have access to list all tables in the region.

0 commit comments

Comments
 (0)