Grant, Don't Hand-Write

What you'll learn

Every Lambda function gets its own IAM role, with no permissions beyond writing its logs.
Grant methods such as table.grantReadData(fn) add a narrow policy for exactly one resource and the actions the method name promises.
Prefer the narrowest grant: grantRead, grantPut or grantReadData over grantReadWrite, and never wildcards.

Section 01

The wildcard trap

Hand-written policy statements are easy to get wrong in the generous direction. A function that only reads cards ends up able to delete the table, and a bug or a compromised dependency inherits all of it. Least privilege means giving each function exactly the actions it needs on exactly the resources it touches.

What to replace

// Too broad: any DynamoDB or S3 action on anything
lookup.addToRolePolicy(new iam.PolicyStatement({
  actions: ["dynamodb:*", "s3:*"],
  resources: ["*"],
}));

Section 02

Grants

Most L2 constructs that own data have grant methods. You pass the principal, which can be a function, a role or a user; CDK adds a statement to that principal's policy with the right actions and the resource's ARN. If the table has indexes, the grant also covers them.

Method	Lets the function	Use for
`grantReadData`	Read items from the table	Lookups
`grantWriteData`	Write and delete items	Importers
`grantRead`	Get and list objects	Serving cards
`grantPut`	Put objects only	Uploaders
`grantReadWrite`	Both directions	Only when it truly does both

Narrow grants

table.grantReadData(lookupFn);   // GetItem, Query, Scan, BatchGetItem, …
bucket.grantRead(lookupFn);      // s3:GetObject*, s3:GetBucket*, s3:List*
bucket.grantPut(uploadFn);       // s3:PutObject, s3:PutObjectLegalHold, … (no read)

Section 03

Read the policy it wrote

Open the exercise output and find the AWS::IAM::Policy resources. The Resource lists are references to the table and bucket, not *. One detail looks odd the first time: a DynamoDB grant ends with Ref: AWS::NoValue in its resource list. CDK adds the table's indexes there when it has any; with no index the slot is empty, and CloudFormation drops it.

Practice

Your turn

Both functions were given every permission on every resource. Delete the wildcard policies and use grants instead: LookupFn reads the table and the card bucket (grantReadData and grantRead; no write access); UploadFn may only put objects (grantPut) into the bucket and must not read them or touch the table.

Remove addToRolePolicy; use table.grantReadData, bucket.grantRead for the lookup and bucket.grantPut for the upload.

import * as cdk from "aws-cdk-lib";
import * as s3 from "aws-cdk-lib/aws-s3";
import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
import * as lambda from "aws-cdk-lib/aws-lambda";
import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";
export class PokedexStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    const table = new dynamodb.Table(this, "PokedexTable", {
      partitionKey: { name: "pokedexNumber", type: dynamodb.AttributeType.NUMBER },
      sortKey: { name: "formId", type: dynamodb.AttributeType.STRING },
      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
    });
    const bucket = new s3.Bucket(this, "CardsBucket", {
      versioned: true,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      enforceSSL: true,
    });
    const lookupFn = new lambda.Function(this, "LookupFn", {
      runtime: lambda.Runtime.NODEJS_22_X,
      handler: "index.handler",
      code: lambda.Code.fromAsset("lambda/lookup"),
      timeout: cdk.Duration.seconds(10),
      memorySize: 256,
      environment: { TABLE_NAME: table.tableName },
    });
    const uploadFn = new lambda.Function(this, "UploadFn", {
      runtime: lambda.Runtime.NODEJS_22_X,
      handler: "upload.handler",
      code: lambda.Code.fromAsset("lambda/upload"),
      environment: { BUCKET_NAME: bucket.bucketName },
    });
    // ⬇️ Too much power! Replace these wildcard policies with grants.
    lookupFn.addToRolePolicy(new iam.PolicyStatement({ actions: ["dynamodb:*", "s3:*"], resources: ["*"] }));
    uploadFn.addToRolePolicy(new iam.PolicyStatement({ actions: ["s3:*"], resources: ["*"] }));
  }
}
const app = new cdk.App();
new PokedexStack(app, "PokedexStack");

import * as cdk from "aws-cdk-lib";
import * as s3 from "aws-cdk-lib/aws-s3";
import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
import * as lambda from "aws-cdk-lib/aws-lambda";
import * as iam from "aws-cdk-lib/aws-iam";
import { Construct } from "constructs";

export class PokedexStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    const table = new dynamodb.Table(this, "PokedexTable", {
      partitionKey: { name: "pokedexNumber", type: dynamodb.AttributeType.NUMBER },
      sortKey: { name: "formId", type: dynamodb.AttributeType.STRING },
      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
    });

    const bucket = new s3.Bucket(this, "CardsBucket", {
      versioned: true,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      enforceSSL: true,
    });

    const lookupFn = new lambda.Function(this, "LookupFn", {
      runtime: lambda.Runtime.NODEJS_22_X,
      handler: "index.handler",
      code: lambda.Code.fromAsset("lambda/lookup"),
      timeout: cdk.Duration.seconds(10),
      memorySize: 256,
      environment: { TABLE_NAME: table.tableName },
    });

    const uploadFn = new lambda.Function(this, "UploadFn", {
      runtime: lambda.Runtime.NODEJS_22_X,
      handler: "upload.handler",
      code: lambda.Code.fromAsset("lambda/upload"),
      environment: { BUCKET_NAME: bucket.bucketName },
    });

    // ⬇️ Too much power! Replace these wildcard policies with grants.
    lookupFn.addToRolePolicy(new iam.PolicyStatement({ actions: ["dynamodb:*", "s3:*"], resources: ["*"] }));
    uploadFn.addToRolePolicy(new iam.PolicyStatement({ actions: ["s3:*"], resources: ["*"] }));
  }
}

const app = new cdk.App();
new PokedexStack(app, "PokedexStack");

Ctrl/⌘ Enter to run · simulated, no AWS callsSimulated — no AWS calls

The simulator runs the constructs this course teaches, plus simple loops and helper methods. Other CDK code may not be recognised.

Check

Check your understanding

Quick Quiz · one question, as many tries as you need.

UploadFn only has to store card images in the bucket. Which grant fits?

Choose one answer.