title: AWS user with "AmazonDynamoDBFullAccess" gets "User is not authorized to perform: dynamodb:PutItem on resource"
body: <p>Every post on "User is not authorized to perform: dynamodb:PutItem on resource" from amazon's <strong>lambda</strong> leads to the same repeatedly stated answer and lots of cheerful reply after the following fix applied:</p>
  
  <blockquote>
    <p>Add the appropriate permissions to the IAM role assigned to the Lambda function.</p>
  </blockquote>
  
  <p>Apparently it is not enough:</p>
  
  <p>"An error occurred (AccessDeniedException) when calling the PutItem operation: User: arn:aws:sts::759832573084:assumed-role/operator/get-orders is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:ap-southeast-2:759832573084:table/queue"</p>
  
  <p>The IAM role assigned to the Lambda function here I believe is the user 'operator', who has:</p>
  
  <ul>
  <li>AWSLambdaFullAccess</li>
  <li>AmazonDynamoDBFullAccess</li>
  <li>AWSLambdaDynamoDBExecutionRole</li>
  <li>AmazonDynamoDBFullAccesswithDataPipeline</li>
  </ul>
  
  <p>As you can see I oversupplied 'operator' user permissions in order to overcome the problem.</p>
  
  <p>Other things I checked are:</p>
  
  <ul>
  <li>The error is reproducible in the AWS console's lambda debugger</li>
  <li>The table 'queue' has a Amazon Resource Name the same as stated in the error message.</li>
  <li>Lambda is created in the same region (Asia Pacific 2) as the dynamodb table.</li>
  <li>lambda documents mentioned that for fine-tuning permission on the table, its primary key has to be a string, so I changed my table 'queue' primary key to a string. Didn't help.</li>
  </ul>
  
  <p>Don't think it's relevant but the language used in the lambda is Python 3.6</p>