title: CognitoIdentityCredentials is not authorized to perform: dynamodb:Query on resource:
body: <p>I have been following along with AWS documentation and example code for DynamoDB use but have come to halt in my progress. After setting up my Cognito User Pool/Identity and IAM Roles correctly, I can no longer Query on my DynamoDB table. I am able to run a scan, delete, and GetItem without problems but cannot run a Query. Is my unauthorized IAM role setup correctly to run Queries on my DynamoDB table? </p>
  
  <p>IAM Unauthorized Role:</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "Stmt1474743569000",
          "Effect": "Allow",
          "Action": [
              "dynamodb:*"
          ],
          "Resource": [
              "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable1"
          ]
      },
      {
          "Sid": "Stmt1474743616000",
          "Effect": "Allow",
          "Action": [
              "dynamodb:*"
          ],
          "Resource": [
              "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable2"
          ]
      }
  ]
  </code></pre>
  
  <p>Query Function:</p>
  
  <pre><code>func getQuery(){
      //performing a query
  
      let dynamoDBObjectMapper = AWSDynamoDBObjectMapper.default()
  
      let queryExpression = AWSDynamoDBQueryExpression()
      //queryExpression.scanIndexForward = 1
      queryExpression.indexName = "Pay"
  
      queryExpression.keyConditionExpression = "Company = :Company AND Pay &gt; :Pay"
  
      queryExpression.expressionAttributeValues = [
          ":Company" : "TestCompany",
          ":Pay" : 0];
  
      dynamoDBObjectMapper .query(DDBTableRow.self, expression: queryExpression) .continue(with: AWSExecutor.mainThread(), with: { (task:AWSTask!) -&gt; AnyObject! in
          if (task.error != nil) {
              print("Error: \(task.error)")
  
              let alertController = UIAlertController(title: "Failed to query a test table.", message: task.error!.localizedDescription, preferredStyle: UIAlertControllerStyle.alert)
              let okAction = UIAlertAction(title: "OK", style: UIAlertActionStyle.cancel, handler: { (action:UIAlertAction) -&gt; Void in
              })
              alertController.addAction(okAction)
              self.present(alertController, animated: true, completion: nil)
          } else {
              if (task.result != nil) {
                  self.pagniatedOutput = task.result! as AWSDynamoDBPaginatedOutput
              }
              //self.performSegue(withIdentifier: "unwindToMainSegue", sender: self)
          }
          return nil
      })
  
  
  }
  </code></pre>
  
  <p>Thank you in advance for any advice!</p>
  
  <p>Update #2:
  Adding in Exception Received:</p>
  
  <pre><code>    Error: Optional(Error Domain=com.amazonaws.AWSServiceErrorDomain Code=6 "(null)" 
  
      UserInfo={__type=com.amazon.coral.service#AccessDeniedException, 
  
      Message=User: arn:aws:sts::XXXXXXXXXX:assumed-role/Cognito_testUserUnauth_Role/CognitoIdentityCredentials is 
      not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable1/index/Pay})
  </code></pre>
  
  <p>Update #3:
  The issue was with the Resource parameter in my IAM role. I made one minor change and am now able to query. </p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "Stmt1474743569000",
          "Effect": "Allow",
          "Action": [
              "dynamodb:*"
          ],
          "Resource": [
              "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable1",
              "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable1/index/*"
          ]
      },
      {
          "Sid": "Stmt1474743616000",
          "Effect": "Allow",
          "Action": [
              "dynamodb:*"
          ],
          "Resource": [
              "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable2",
              "arn:aws:dynamodb:us-east-1:XXXXXXXXXXXX:table/MyTable2/index/*"
          ]
      }
  ]
  </code></pre>