Docs(dynamodb): add missing dynamodb:TagResource permission for feast apply

[anix-lynch]

Summary

When using the tags config option in the DynamoDB online store, feast apply requires the dynamodb:TagResource IAM permission. This permission was missing from both the permissions table and the inline policy example in the docs.

Root Cause

The DynamoDB online store calls TagResource when tags are configured in feature_store.yaml. Without this permission, feast apply fails with a cryptic AccessDeniedException that doesn't point to the missing permission.

Changes

• Added dynamodb:TagResource to the Apply row in the permissions table
• Added dynamodb:TagResource to the inline policy JSON example

Reproduction

online_store:
  type: dynamodb
  region: us-east-1
  tags:
    env: production

Running feast apply with the above config and without dynamodb:TagResource in the IAM policy throws AccessDeniedException.

Workaround: remove tags from config OR add dynamodb:TagResource to the IAM policy.

Closes #6085

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

[shuchu]

@anix-lynch please Sign your commit for passing the DCO check.

[devin-ai-integration]

Devin Review found 1 new potential issue.

View 2 additional findings in Devin Review.

[devin-ai-integration]

🟡 Documentation adds only dynamodb:TagResource but code also requires UntagResource and ListTagsOfResource

The documentation adds dynamodb:TagResource to the required permissions, but the _update_tags method at sdk/python/feast/infra/online_stores/dynamodb.py:240-252 also calls dynamodb_client.list_tags_of_resource() and dynamodb_client.untag_resource(). A user who follows this documentation and grants only TagResource will find that tag updates still fail (caught by the AccessDeniedException handler at line 344, so not a crash, but tags silently won't be applied). The permissions table and IAM policy should also include dynamodb:UntagResource and dynamodb:ListTagsOfResource for tag operations to actually succeed.

Prompt for agents

In docs/reference/online-stores/dynamodb.md, line 72, add dynamodb:UntagResource and dynamodb:ListTagsOfResource to the Apply permissions in the table row. The current line only lists dynamodb:TagResource but the code in sdk/python/feast/infra/online_stores/dynamodb.py:240-252 also calls list_tags_of_resource and untag_resource. Similarly, in the IAM policy JSON block (around lines 83-88), add "dynamodb:UntagResource" and "dynamodb:ListTagsOfResource" to the Action array.

---

Was this helpful? React with 👍 or 👎 to provide feedback.