Grant a Compute Service Access to a DynamoDB Table

Your compute service (Lambda, EC2, or ECS) is connected to a DynamoDB table, but its IAM role has no dynamodb:* permissions. The stack deploys, but every read/write returns AccessDeniedException at runtime. On the canvas, the compute→table edge lets CloudStack Canvas generate a scoped policy automatically. If you manage your own IAM Role node, add the DynamoDB actions below.

Paste into this field

IAM Role → permissions policy (or draw the edge on the canvas)

Output looks like

Canvas edge: Lambda → DynamoDB (auto-generates a dynamodb:GetItem/PutItem policy)

1Option A (recommended) — let CloudStack Canvas generate it

Without a custom IAM Role node, the auto-created role gets a least-privilege DynamoDB policy as soon as the edge exists. Re-draw the compute→table edge and re-export.

3Option B — fix the role in the AWS console and accept the warning

If you manage your own IAM Role node on the canvas, the validation warning will persist in CSC even after you add the policy in AWS. The warning is advisory — it alerts you that the canvas role node lacks these permissions. Add the policy below in AWS, and the template will deploy correctly; the canvas warning remains until you edit the canvas-based role definition.

5Paste a scoped policy

Replace REGION, ACCOUNT, and MyTable. The /index/* resource line is needed only if your code queries a Global or Local Secondary Index.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "dynamodb:GetItem", "dynamodb:PutItem",
      "dynamodb:UpdateItem", "dynamodb:DeleteItem",
      "dynamodb:Query", "dynamodb:Scan",
      "dynamodb:BatchGetItem", "dynamodb:BatchWriteItem"
    ],
    "Resource": [
      "arn:aws:dynamodb:REGION:ACCOUNT:table/MyTable",
      "arn:aws:dynamodb:REGION:ACCOUNT:table/MyTable/index/*"
    ]
  }]
}

8Save the policy

Name it AllowDynamoDBAccess and click "Create policy".

Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.

CloudStack Canvas · Validation Guide