cf-dynamo-db-scan-policy

gistfile1.txt

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "An IAM Policy that only allows scan access to a specified DynamoDB table",
    "Parameters": {
        "TableArn": {
            "Description": "ARN of the DynamoDB table to allow access to",
            "Type": "String"
        },
        "NamePrefix": {
            "Description": "Prefix to attach to the policy name",
            "Type": "String"
        }
    },
    "Resources": {
        "IAMPolicy": {
            "Type": "AWS::IAM::ManagedPolicy",
            "Properties": {
                "ManagedPolicyName": {
                    "Fn::Sub" : [ "${Prefix}-DynamoDBScannerPolicy", { "Prefix": {"Ref": "NamePrefix"}}]
                },
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": [
                                "dynamodb:Scan"
                            ],
                            "Resource": {
                                "Ref": "TableArn"
                            }
                        }
                    ]
                }
            }
        }
    }
}