Security and Access Control

DynamoDB provides multiple layers of security, from IAM-based access control to encryption at rest and in transit. This lesson covers how to secure your DynamoDB tables, control access with fine-grained permissions, and protect data in compliance-sensitive environments.

---

IAM-Based Access Control

All access to DynamoDB is controlled through AWS Identity and Access Management (IAM):

IAM Policy Structure

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:Query",
        "dynamodb:PutItem"
      ],
      "Resource": "arn:aws:dynamodb:eu-west-1:123456789012:table/Orders"
    }
  ]
}

Common DynamoDB IAM Actions

Action	Description
dynamodb:GetItem	Read a single item
dynamodb:PutItem	Write a single item
dynamodb:UpdateItem	Update a single item
dynamodb:DeleteItem	Delete a single item
dynamodb:Query	Query items in a table or index
dynamodb:Scan	Scan an entire table or index
dynamodb:BatchGetItem	Batch read items
dynamodb:BatchWriteItem	Batch write items
dynamodb:CreateTable	Create a table
dynamodb:DeleteTable	Delete a table
dynamodb:DescribeTable	View table metadata
dynamodb:UpdateTable	Modify table settings

---

Fine-Grained Access Control