title: What IAM permissions does a Kinesis Consumer need when using KCL?
body: <p>I have a Kinesis consumer I wrote using the Kinesis Client Library (KCL). This consumer is running under an assumed IAM role.</p>
  
  <p>I've read from the <a href="https://docs.aws.amazon.com/streams/latest/dev/kinesis-record-processor-implementation-app-java.html" rel="nofollow noreferrer">documentation</a> that:</p>
  
  <blockquote>
    <p>The KCL creates a DynamoDB table with the application name and uses the table to maintain state information (such as checkpoints and worker-shard mapping) for the application. Each application has its own DynamoDB table. For more information, see Tracking Amazon Kinesis Data Streams Application State.</p>
  </blockquote>
  
  <p>Sure, I need to add the <code>dynamodb:CreateTable</code> permission to my IAM role. However, I'm getting errors for other things, (e.g. <code>dynamodb:DescribeTable</code>).</p>
  
  <p>Is there a list of all DynamoDB operations my KCL consumer needs access to? The documentation seems to be lacking and I'd rather have an authoritative list than keep trying to run my application.</p>