title: How can I use two different credentials with dynamodb to have a readonly user and an all access user?
body: <p>I am building out a product that will use the serverless architecture on Amazon (using this <a href="https://github.com/serverless/examples/tree/master/aws-python-rest-api-with-dynamodb" rel="nofollow noreferrer">example project</a>).</p>
  
  <p>Right now the product is usable by anyone. However, I don't want just anyone to be able to add/update/delete from the database. I <em>do</em> want anyone to be able to <em>read</em> from it though. So, I'd like to use two different sets of credentials. The first would be distributed with the application and would allow read only access. The second set remains internal and would be embedded in OS variables that the application would utilize.</p>
  
  <p>It looks like these permissions are set up in the <a href="https://github.com/serverless/examples/blob/master/aws-python-rest-api-with-dynamodb/serverless.yml" rel="nofollow noreferrer">serverless.yml</a> file, but this is only for one set of credentials.</p>
  
  <pre><code>  iamRoleStatements:
      - Effect: Allow
        Action:
          - dynamodb:Query
          - dynamodb:Scan
          - dynamodb:GetItem
          - dynamodb:PutItem
          - dynamodb:UpdateItem
          - dynamodb:DeleteItem
  Resource: "arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.DYNAMODB_TABLE}"
  </code></pre>
  
  <p>How I can set up two different roles?</p>