DynamoDb AccessDeniedException when apparently making identical queries to table

Question

I have two API calls to the BE that are fired simultaneously. Both access the same record in a DynamoDb table.

90% of the time, there is no issue.

10% of the time, I get the following error:

pynamodb.exceptions.QueryError: Failed to query items: An error occurred (AccessDeniedException) on request (KKTVJ3GL22G1053VDGJM3U4T17VV4KQNSO5AEMVJF66Q9ASUAAJG) on table (account_entity_links) when calling the Query operation

This clearly does not have anything to do with permissions. My intuition tells me this has to do with the "almost" simultaneous access.

Is there any restrictions in DynamoDB with two calls accessing a record simultaneously?

Answer 1

Is there any restrictions in DynamoDB with two calls accessing a record simultaneously?

No.

The AWS docs mention

AccessDeniedException Message: Access denied.

The client did not correctly sign the request. If you are using an AWS SDK, requests are signed for you automatically; otherwise, go to the Signature version 4 signing process in the AWS General Reference.

I don't know anything about pynamnodb, but you might check to see if there's a newer version than what you're currently using.

Answer 2

The exception is clear, the role you are using does not have permission to perform a Query operation on table account_entity_links.

You state that 90% of the time the operation works, while 10% of the time it does not. My assumption here is that 90% of the time you operate on the base table, while 10% of the time you try to Query and index for which you are lacking permissions.

Other things to check is that pynamodb is picking up the expected role for each API you call.