Security and Access Control

DynamoDB provides multiple layers of security, from IAM-based access control to encryption at rest and in transit. This lesson covers how to secure your DynamoDB tables, control access with fine-grained permissions, and protect data in compliance-sensitive environments.

---

IAM-Based Access Control

All access to DynamoDB is controlled through AWS Identity and Access Management (IAM):

IAM Policy Structure

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:Query",
        "dynamodb:PutItem"
      ],
      "Resource": "arn:aws:dynamodb:eu-west-1:123456789012:table/Orders"
    }
  ]
}

Common DynamoDB IAM Actions

Action	Description
dynamodb:GetItem	Read a single item
dynamodb:PutItem	Write a single item
dynamodb:UpdateItem	Update a single item
dynamodb:DeleteItem	Delete a single item
dynamodb:Query	Query items in a table or index
dynamodb:Scan	Scan an entire table or index
dynamodb:BatchGetItem	Batch read items
dynamodb:BatchWriteItem	Batch write items
dynamodb:CreateTable	Create a table
dynamodb:DeleteTable	Delete a table
dynamodb:DescribeTable	View table metadata
dynamodb:UpdateTable	Modify table settings

---

Fine-Grained Access Control

DynamoDB supports condition keys in IAM policies to restrict access at the item and attribute level:

Restrict Access by Partition Key Value

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:Query"
      ],
      "Resource": "arn:aws:dynamodb:eu-west-1:123456789012:table/UserData",
      "Condition": {
        "ForAllValues:StringEquals": {
          "dynamodb:LeadingKeys": [
            "\${aws:PrincipalTag/UserId}"
          ]
        }
      }
    }
  ]
}

This policy ensures users can only access items where the partition key matches their own UserId tag.

Restrict Access to Specific Attributes

{
  "Condition": {
    "ForAllValues:StringEquals": {
      "dynamodb:Attributes": [
        "UserId", "Name", "Email"
      ]
    },
    "StringEqualsIfExists": {
      "dynamodb:Select": "SPECIFIC_ATTRIBUTES"
    }
  }
}

This restricts the user to only reading or writing the specified attributes.

---

Encryption

Encryption at Rest

DynamoDB encrypts all data at rest by default. You cannot disable encryption. Three key management options are available:

Option	Description	Cost
AWS owned keys	Default; AWS manages the keys entirely	Free
AWS managed key (aws/dynamodb)	Visible in KMS; automatic rotation	KMS charges
Customer managed key (CMK)	You create and manage the key in KMS	KMS charges

Changing the Encryption Key

aws dynamodb update-table \
  --table-name MyTable \
  --sse-specification \
    Enabled=true,SSEType=KMS,KMSMasterKeyId=alias/my-key

Encryption in Transit

All communication with DynamoDB uses HTTPS (TLS). There is no option to disable TLS — all API calls are encrypted in transit.

---

VPC Endpoints

By default, DynamoDB API calls travel over the public internet (even from within a VPC). A VPC Gateway Endpoint keeps traffic on the AWS private network:

Creating a VPC Endpoint

aws ec2 create-vpc-endpoint \
  --vpc-id vpc-abc123 \
  --service-name com.amazonaws.eu-west-1.dynamodb \
  --route-table-ids rtb-abc123

Benefits