title: Problems accessing storage from Lambda function in Amplify
body: <h2>What I want to do?</h2>
  <p>I want to create REST API that returns data from my DynamoDB table which is being created by GraphQL model.</p>
  <h2>What I've done</h2>
  <ol>
  <li>Create GraphQL model</li>
  </ol>
  <pre><code>type Public @model {
    id: ID!
    name: String!
  }
  </code></pre>
  <ol start="2">
  <li>Create REST API with Lambda Function with access to my <code>PublicTable</code></li>
  </ol>
  <pre class="lang-sh prettyprint-override"><code>$ amplify add api
  ? Please select from one of the below mentioned services: REST
  ? Provide a friendly name for your resource to be used as a label for this category in the project: rest
  ? Provide a path (e.g., /book/{isbn}): /items
  ? Choose a Lambda source Create a new Lambda function
  ? Provide an AWS Lambda function name: listPublic
  ? Choose the runtime that you want to use: NodeJS
  ? Choose the function template that you want to use: Hello World
  
  Available advanced settings:
  - Resource access permissions
  - Scheduled recurring invocation
  - Lambda layers configuration
  
  ? Do you want to configure advanced settings? Yes
  ? Do you want to access other resources in this project from your Lambda function? Yes
  ? Select the category storage
  ? Storage has 8 resources in this project. Select the one you would like your Lambda to access Public:@model(appsync)
  ? Select the operations you want to permit for Public:@model(appsync) create, read, update, delete
  
  You can access the following resource attributes as environment variables from your Lambda function
          API_MYPROJECT_GRAPHQLAPIIDOUTPUT
          API_MYPROJECT_PUBLICTABLE_ARN
          API_MYPROJECT_PUBLICTABLE_NAME
          ENV
          REGION
  ? Do you want to invoke this function on a recurring schedule? No
  ? Do you want to configure Lambda layers for this function? No
  ? Do you want to edit the local lambda function now? No
  Successfully added resource listPublic locally.
  
  Next steps:
  Check out sample function code generated in &lt;project-dir&gt;/amplify/backend/function/listPublic/src
  &quot;amplify function build&quot; builds all of your functions currently in the project
  &quot;amplify mock function &lt;functionName&gt;&quot; runs your function locally
  &quot;amplify push&quot; builds all of your local backend resources and provisions them in the cloud
  &quot;amplify publish&quot; builds all of your local backend and front-end resources (if you added hosting category) and provisions them in the cloud
  Succesfully added the Lambda function locally
  ? Restrict API access No
  ? Do you want to add another path? No
  Successfully added resource rest locally
  </code></pre>
  <ol start="4">
  <li>Edit my Lambda function</li>
  </ol>
  <pre class="lang-js prettyprint-override"><code>/* Amplify Params - DO NOT EDIT
      API_MYPROJECT_GRAPHQLAPIIDOUTPUT
      API_MYPROJECT_PUBLICTABLE_ARN
      API_MYPROJECT_PUBLICTABLE_NAME
      ENV
      REGION
  Amplify Params - DO NOT EDIT */
  
  const AWS = require(&quot;aws-sdk&quot;);
  const region = process.env.REGION
  
  AWS.config.update({ region });
  
  const docClient = new AWS.DynamoDB.DocumentClient();
  
  const params = {
      TableName: &quot;PublicTable&quot;
  }
  
  async function listItems(){
      try {
        const data = await docClient.scan(params).promise()
        return data
      } catch (err) {
        return err
      }
  }
  
  exports.handler = async (event) =&gt; {
      try {
          const data = await listItems()
          return { body: JSON.stringify(data) }
        } catch (err) {
          return { error: err }
      }
  };
  </code></pre>
  <ol start="4">
  <li>Push my updates</li>
  </ol>
  <pre class="lang-sh prettyprint-override"><code>$ amplify push
  </code></pre>
  <ol start="5">
  <li>Open my REST API endpoint <code>/items</code></li>
  </ol>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;message&quot;: &quot;User: arn:aws:sts::829736458236:assumed-role/myprojectLambdaRolef4f571b-dev/listPublic-dev is not authorized to perform: dynamodb:Scan on resource: arn:aws:dynamodb:us-east-1:8297345848236:table/Public-ssrh52tnjvcdrp5h7evy3zdldsd-dev&quot;,
    &quot;code&quot;: &quot;AccessDeniedException&quot;,
    &quot;time&quot;: &quot;2021-04-21T21:21:32.778Z&quot;,
    &quot;requestId&quot;: &quot;JOA5KO3GVS3QG7RQ2V824NGFVV4KQNSO5AEMVJF66Q9ASUAAJG&quot;,
    &quot;statusCode&quot;: 400,
    &quot;retryable&quot;: false,
    &quot;retryDelay&quot;: 28.689093010346657
  }
  </code></pre>
  <h2>Problems</h2>
  <ol>
  <li>What I did wrong?</li>
  <li>How do I access my table and why I didn't get it when I created it?</li>
  <li>Why <code>API_MYPROJECT_PUBLICTABLE_NAME</code> and other constants are needed?</li>
  </ol>