No ParameterStore access with sub path definition

Question

I have the following policy in place which works fine on any parameter within /network/testnet/*

{
    "Statement": [
        {
            "Action": [
                "ssm:DescribeParameters"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ssm:GetParameters",
                "ssm:GetParameter",
                "ssm:GetParametersByPath"
            ],
            "Resource": "arn:aws:ssm:eu-central-1:xx:parameter/network/*",
            "Effect": "Allow"
        }
    ]
}

but as soon as I want to restrict the resource to arn:aws:ssm:eu-central-1:xx:parameter/network/testnet/* it does no longer allow access to any of the parameters within /network/testnet/*.

My lambda function then gets the following error

"errorType": "Runtime.UnhandledPromiseRejection",
    "errorMessage": "AccessDeniedException: User: arn:aws:sts::xxx:assumed-role/dsome-app/some-function is not authorized to perform: ssm:GetParametersByPath on resource: arn:aws:ssm:eu-central-1:xxx:parameter/network/testnet because no identity-based policy allows the ssm:GetParametersByPath action",

Specifically I use CloudFormation and define access like that

Policies:
      - SSMParameterReadPolicy:
          ParameterName: "network/testnet/*"

Are restriction to sub paths not allowed or what am I missing?

Answer 1

You should be able to do dynamoose.model('example_user', schema, {"create": false}) to get away from the need to create a table https://dynamoosejs.com/guide/Model/