API Lambda IAM Role

Goal

Create an IAM role for the API Lambda that can:

read people metadata from DynamoDB (Persons)
query person → photo mappings from DynamoDB (Occurrences)
fetch photo metadata from DynamoDB (Photos)
write logs to CloudWatch

Least privilege

Do not use broad policies like AdministratorAccess. We'll grant only the exact permissions this Lambda needs.

Create the IAM role

Go to IAM → Roles → Create role
Trusted entity: AWS service
Use case: Lambda
Click on Next
Skip to Step 3 by clicking on Name, review and create on the step indicator
Role name: beetroot-api-role
Click Create role

Add logging permissions

Open the role: IAM → Roles → beetroot-ingest-role
Go to Permissions → Add permissions → Attach policies
Select: AWSLambdaBasicExecutionRole
Click Add Permissions

Create the permissions policy

We'll build a least-privilege policy using the visual editor, and then you can verify it with JSON.

Open the role: IAM → Roles → beetroot-ingest-role
Click Add permissions → Create inline policy
Choose the Visual editor (not JSON)

Select service: DynamoDB
Under Actions:
- Expand Read and select:
  - GetItem
  - Query
  - Scan
Under Resources:
- Choose Specific
- In Table, click Add ARN
In the Add ARN popup, add these 3 table ARNs (same region: us-east-1): Persons table
- Table name: Persons
- Table ARN: arn:aws:dynamodb:us-east-1:<ACCOUNT_ID>:table/Persons
Occurrences table
- Table name: Occurrences
- Table ARN: arn:aws:dynamodb:us-east-1:<ACCOUNT_ID>:table/Occurrences
Photos table
- Table name: Photos
- Table ARN: arn:aws:dynamodb:us-east-1:<ACCOUNT_ID>:table/Photos
Where do I get <ACCOUNT_ID>?
Run aws sts get-caller-identity and copy the Account value or copy it from top-right corner of console.

Save the inline policy

Click Next
Policy name: BeetrootAPIPolicy
Click Create policy

You can verify your policy configuration by switching to the JSON editor and comparing it against the policy document below. Alternatively, paste the following JSON directly to attach all required permissions at once.

Replace bucket names if yours differ.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DynamoReadForApi",
      "Effect": "Allow",
      "Action": ["dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan"],
      "Resource": [
        "arn:aws:dynamodb:us-east-1:<ACCOUNT_ID>:table/Persons",
        "arn:aws:dynamodb:us-east-1:<ACCOUNT_ID>:table/Occurrences",
        "arn:aws:dynamodb:us-east-1:<ACCOUNT_ID>:table/Photos"
      ]
    }
  ]
}

Checkpoint

In the role's Permissions tab, you should see:

AWSLambdaBasicExecutionRole
BeetrootAPIPolicy