title: How to solve (AccessDeniedException) when calling the Scan operation: User: arn:aws:sts... is not authorized to perform: dynamodb:Scan on resource.."?
body: <p>I am trying to deploy an Instagram-like application to AWS using Elastic Beanstalk and Flask. After using <strong>eb deploy</strong> command, I am able to access the application main page, which does not requires access to DynamoDB tables. When I try to login, the application should access a DynamoDB table to retrieve data, such as number of likes in pictures, however it shows an </p>
  
  <blockquote>
    <p>500 Internal Server Error</p>
  </blockquote>
  
  <p>And my <strong>eb logs</strong> returns this error.</p>
  
  <blockquote>
    <p>ClientError: An error occurred (AccessDeniedException) when calling the >Scan operation: User: arn:aws:sts::013051511429:assumed-role/aws->elasticbeanstalk-ec2-role/i-049593eb550052c8f is not authorized to >perform: dynamodb:Scan on resource: arn:aws:dynamodb:us-east->1:013051511429:table/cloudgram</p>
  </blockquote>
  
  <p>I think this is happening because of an <strong>IAM</strong> misconfiguration, it says that the user corresponding to my EC2 Instance (i-04959..) is not authorized to perfom a Scan on my DynamoDB table. </p>
  
  <p>I have tried following this:
  <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-api.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-api.html</a></p>
  
  <p>These are the policies I have attached to my aws-elasticbeanstalk-ec2-role:</p>
  
  <ul>
  <li>AmazonRDSFullAccess</li>
  <li>AmazonS3FullAccess</li>
  <li>AWSLambdaDynamoDBExecutionRole</li>
  <li>AWSElasticBeanstalkWebTier</li>
  <li>AWSElasticBeanstalkMulticontainerDocker</li>
  <li>AWSElasticBeanstalkWorkerTier</li>
  </ul>
  
  <p>I'm using:
   Python 2.7
   Flask 1.0.2</p>