Skip to content

delete_resource_policy

delete_resource_policy(
    resource_arn: ResourceArnString,
    *,
    config_overrides: Optional[DynamoDBClientConfig] = None,
    expected_revision_id: Optional[PolicyRevisionId] = None,
) -> DeleteResourcePolicyOutput

Deletes the resource-based policy attached to the resource, which can be a table or stream.

DeleteResourcePolicy is an idempotent operation; running it multiple times on the same resource doesn't result in an error response, unless you specify an ExpectedRevisionId, which will then return a PolicyNotFoundException.

To make sure that you don't inadvertently lock yourself out of your own resources, the root principal in your Amazon Web Services account can perform DeleteResourcePolicy requests, even if your resource-based policy explicitly denies the root principal's access.

DeleteResourcePolicy is an asynchronous operation. If you issue a GetResourcePolicy request immediately after running the DeleteResourcePolicy request, DynamoDB might still return the deleted policy. This is because the policy for your resource might not have been deleted yet. Wait for a few seconds, and then try the GetResourcePolicy request again.

Parameters:

  • resource_arn (ResourceArnString) –

    The Amazon Resource Name (ARN) of the DynamoDB resource from which the policy will be removed. The resources you can specify include tables and streams. If you remove the policy of a table, it will also remove the permissions for the table's indexes defined in that policy document. This is because index permissions are defined in the table's policy.

  • expected_revision_id (Optional[PolicyRevisionId], default: None ) –

    A string value that you can use to conditionally delete your policy. When you provide an expected revision ID, if the revision ID of the existing policy on the resource doesn't match or if there's no policy attached to the resource, the request will fail and return a PolicyNotFoundException.

Raises:

  • InternalServerError –

    An error occurred on the server side.

  • LimitExceededException –

    There is no limit to the number of daily on-demand backups that can be taken.

    For most purposes, up to 500 simultaneous table operations are allowed per account. These operations include CreateTable, UpdateTable, DeleteTable,UpdateTimeToLive, RestoreTableFromBackup, and RestoreTableToPointInTime.

    When you are creating a table with one or more secondary indexes, you can have up to 250 such requests running at a time. However, if the table or index specifications are complex, then DynamoDB might temporarily reduce the number of concurrent operations.

    When importing into DynamoDB, up to 50 simultaneous import table operations are allowed per account.

    There is a soft account quota of 2,500 tables.

    GetRecords was called with a value of more than 1000 for the limit request parameter.

    More than 2 processes are reading from the same streams shard at the same time. Exceeding this limit may result in request throttling.

  • PolicyNotFoundException –

    The operation tried to access a nonexistent resource-based policy.

    If you specified an ExpectedRevisionId, it's possible that a policy is present for the resource but its revision ID didn't match the expected value.

  • ResourceInUseException –

    The operation conflicts with the resource's availability. For example:

    • You attempted to recreate an existing table.

    • You tried to delete a table currently in the CREATING state.

    • You tried to update a resource that was already being updated.

    When appropriate, wait for the ongoing update to complete and attempt the request again.

  • ResourceNotFoundException –

    The operation tried to access a nonexistent table or index. The resource might not be specified correctly, or its status might not be ACTIVE.

  • UnknownServiceError –

    The service returned an error code this client does not model.

Source code in docs_src/capo_dynamodb/_services/dynamo_db.py
def delete_resource_policy(
    self,
    resource_arn: "capo_dynamodb.types.resource_arn_string.ResourceArnString",
    *,
    config_overrides: Optional[DynamoDBClientConfig] = None,
    expected_revision_id: Optional[
        "capo_dynamodb.types.policy_revision_id.PolicyRevisionId"
    ] = None,
) -> "capo_dynamodb.types.delete_resource_policy_output.DeleteResourcePolicyOutput":
    """<p>Deletes the resource-based policy attached to the resource, which can be a table or stream.</p> <p> <code>DeleteResourcePolicy</code> is an idempotent operation; running it multiple times on the same resource <i>doesn't</i> result in an error response, unless you specify an <code>ExpectedRevisionId</code>, which will then return a <code>PolicyNotFoundException</code>.</p> <important> <p>To make sure that you don't inadvertently lock yourself out of your own resources, the root principal in your Amazon Web Services account can perform <code>DeleteResourcePolicy</code> requests, even if your resource-based policy explicitly denies the root principal's access. </p> </important> <note> <p> <code>DeleteResourcePolicy</code> is an asynchronous operation. If you issue a <code>GetResourcePolicy</code> request immediately after running the <code>DeleteResourcePolicy</code> request, DynamoDB might still return the deleted policy. This is because the policy for your resource might not have been deleted yet. Wait for a few seconds, and then try the <code>GetResourcePolicy</code> request again.</p> </note>

    Args:
        resource_arn: <p>The Amazon Resource Name (ARN) of the DynamoDB resource from which the policy will be removed. The resources you can specify include tables and streams. If you remove the policy of a table, it will also remove the permissions for the table's indexes defined in that policy document. This is because index permissions are defined in the table's policy.</p>
        expected_revision_id: <p>A string value that you can use to conditionally delete your policy. When you provide an expected revision ID, if the revision ID of the existing policy on the resource doesn't match or if there's no policy attached to the resource, the request will fail and return a <code>PolicyNotFoundException</code>.</p>

    Raises:
        capo_dynamodb.errors.internal_server_error.InternalServerError: <p>An error occurred on the server side.</p>
        capo_dynamodb.errors.invalid_endpoint_exception.InvalidEndpointException
        capo_dynamodb.errors.limit_exceeded_exception.LimitExceededException: <p>There is no limit to the number of daily on-demand backups that can be taken. </p> <p>For most purposes, up to 500 simultaneous table operations are allowed per account. These operations include <code>CreateTable</code>, <code>UpdateTable</code>, <code>DeleteTable</code>,<code>UpdateTimeToLive</code>, <code>RestoreTableFromBackup</code>, and <code>RestoreTableToPointInTime</code>. </p> <p>When you are creating a table with one or more secondary indexes, you can have up to 250 such requests running at a time. However, if the table or index specifications are complex, then DynamoDB might temporarily reduce the number of concurrent operations.</p> <p>When importing into DynamoDB, up to 50 simultaneous import table operations are allowed per account.</p> <p>There is a soft account quota of 2,500 tables.</p> <p>GetRecords was called with a value of more than 1000 for the limit request parameter.</p> <p>More than 2 processes are reading from the same streams shard at the same time. Exceeding this limit may result in request throttling.</p>
        capo_dynamodb.errors.policy_not_found_exception.PolicyNotFoundException: <p>The operation tried to access a nonexistent resource-based policy.</p> <p>If you specified an <code>ExpectedRevisionId</code>, it's possible that a policy is present for the resource but its revision ID didn't match the expected value.</p>
        capo_dynamodb.errors.resource_in_use_exception.ResourceInUseException: <p>The operation conflicts with the resource's availability. For example:</p> <ul> <li> <p>You attempted to recreate an existing table.</p> </li> <li> <p>You tried to delete a table currently in the <code>CREATING</code> state.</p> </li> <li> <p>You tried to update a resource that was already being updated.</p> </li> </ul> <p>When appropriate, wait for the ongoing update to complete and attempt the request again.</p>
        capo_dynamodb.errors.resource_not_found_exception.ResourceNotFoundException: <p>The operation tried to access a nonexistent table or index. The resource might not be specified correctly, or its status might not be <code>ACTIVE</code>.</p>
        capo_dynamodb.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_dynamodb.types.delete_resource_policy_input.DeleteResourcePolicyInput]",
    ) -> OperationResponse[
        "capo_dynamodb.types.delete_resource_policy_output.DeleteResourcePolicyOutput"
    ]:
        import capo_dynamodb._operations.dynamo_db_20120810.delete_resource_policy

        output, http_response = (
            capo_dynamodb._operations.dynamo_db_20120810.delete_resource_policy.delete_resource_policy(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("DeleteResourcePolicy")
    )
    input_: capo_dynamodb.types.delete_resource_policy_input.DeleteResourcePolicyInput = {
        "resource_arn": resource_arn
    }
    if expected_revision_id is not None:
        input_["expected_revision_id"] = expected_revision_id

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output