# Aws dynamodb kinesis streaming destination IAM issue

**URL:** <https://discuss.hashicorp.com/t/aws-dynamodb-kinesis-streaming-destination-iam-issue/49549>\
**Category:** AWS\
**Created:** [January 31, 2023, 5:40pm UTC](https://discuss.hashicorp.com/t/aws-dynamodb-kinesis-streaming-destination-iam-issue/49549 "2023-01-31T17:40:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dilaodilao](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/dilaodilao/32/30448_2.png) [@dilaodilao](https://discuss.hashicorp.com/u/dilaodilao)\
**Post date:** [January 31, 2023, 5:40pm UTC](https://discuss.hashicorp.com/t/aws-dynamodb-kinesis-streaming-destination-iam-issue/49549/1 "2023-01-31T17:40:15Z")

</div>

have a bare bones config (excluding the data stuff)

```auto
resource "aws_dynamodb_kinesis_streaming_destination" "example" {
        table_name = data.aws_dynamodb_table.tabledata.arn
        stream_arn = data.aws_kinesis_stream.stream.arn
}

```

however when I try to create it, i get an error that I do not have permissions to create it. This is using the admin role. I’m able to create this through the web console with the same role. And looking at the cloudtrail logs, I see the same event name.

The web console was successful. however the terraform one was not.

```auto
"userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.3.3 (+https://www.terraform.io) terraform-provider-aws/4.52.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.186 (go1.19.3; linux; amd64)",

```

```auto
Plan: 1 to add, 0 to change, 0 to destroy.
aws_dynamodb_kinesis_streaming_destination.table---stream: Creating...
╷
│ Error: error enabling DynamoDB Kinesis streaming destination (stream: arn:aws:kinesis:us-east-1:<acct>:stream/stream, table: arn:aws:dynamodb:us-east-1:<acct>:table/table): AccessDeniedException: User: arn:aws:sts::<acct>:assumed-role/super_admin_role/admin_terraform is not authorized to perform: dynamodb:EnableKinesisStreamingDestination on resource: arn:aws:dynamodb:us-east-1:<acct>:table/arn:aws:dynamodb:us-east-1:<acct>:table/table
│ status code: 400, request id:

```

has anyone been able to create this successfully on terraform?

---

<div class="post-metadata">

**Author:** ![debojitroy](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/debojitroy/32/35397_2.png) [@debojitroy](https://discuss.hashicorp.com/u/debojitroy)\
**Post date:** [April 27, 2023, 8:20am UTC](https://discuss.hashicorp.com/t/aws-dynamodb-kinesis-streaming-destination-iam-issue/49549/2 "2023-04-27T08:20:09Z")

</div>

+1

Having the same issue. I am able to do it from Console.