Condition keys for row-level security in DynamoDB - Mini Project: Build & Apply

Condition keys for row-level security

📖 Scenario: You are building a simple user data table in DynamoDB. Each user should only be able to access their own data. To do this, you will use condition keys to enforce row-level security.

🎯 Goal: Create a DynamoDB table with user data, set up a condition key for user ID, and write a policy condition that allows access only to the user's own data.

📋 What You'll Learn

Create a DynamoDB table named UserData with a primary key UserId (string).

Create a variable user_id with the value "user123".

Write a condition expression that allows access only when UserId equals user_id.

Add a policy statement that uses the condition expression for row-level security.

💡 Why This Matters

🌍 Real World

Row-level security is important in applications where users should only see or modify their own data, such as personal profiles, orders, or messages.

💼 Career

Understanding how to use condition keys in DynamoDB policies is valuable for roles in cloud security, backend development, and database administration.

1

Create the DynamoDB table structure

Create a DynamoDB table named UserData with a primary key called UserId of type string.

DynamoDB

# Define the DynamoDB table structure
# Your code here

Hint

Use a dictionary to define the table with TableName, KeySchema, and AttributeDefinitions.

2

Set the user ID variable

Create a variable called user_id and set it to the string "user123".

DynamoDB

UserData = {
    'TableName': 'UserData',
    'KeySchema': [
        {'AttributeName': 'UserId', 'KeyType': 'HASH'}
    ],
    'AttributeDefinitions': [
        {'AttributeName': 'UserId', 'AttributeType': 'S'}
    ],
    'ProvisionedThroughput': {
        'ReadCapacityUnits': 5,
        'WriteCapacityUnits': 5
    }
}
# Create the user_id variable
# Your code here

Hint

Assign the string "user123" to the variable user_id.

3

Write the condition expression for row-level security

Create a variable called condition_expression that checks if UserId equals user_id using the expression "UserId = :user_id".

DynamoDB

UserData = {
    'TableName': 'UserData',
    'KeySchema': [
        {'AttributeName': 'UserId', 'KeyType': 'HASH'}
    ],
    'AttributeDefinitions': [
        {'AttributeName': 'UserId', 'AttributeType': 'S'}
    ],
    'ProvisionedThroughput': {
        'ReadCapacityUnits': 5,
        'WriteCapacityUnits': 5
    }
}

user_id = "user123"
# Create the condition_expression variable
# Your code here

Hint

Use a string to represent the condition expression comparing UserId to :user_id.

4

Add the policy statement with the condition

Create a dictionary called policy_statement with the keys Effect set to "Allow", Action set to ["dynamodb:GetItem"], Resource set to "arn:aws:dynamodb:::table/UserData", and Condition set to a dictionary with key "ForAllValues:StringEquals" mapping to a dictionary with "dynamodb:LeadingKeys" equal to a list containing user_id.

DynamoDB

UserData = {
    'TableName': 'UserData',
    'KeySchema': [
        {'AttributeName': 'UserId', 'KeyType': 'HASH'}
    ],
    'AttributeDefinitions': [
        {'AttributeName': 'UserId', 'AttributeType': 'S'}
    ],
    'ProvisionedThroughput': {
        'ReadCapacityUnits': 5,
        'WriteCapacityUnits': 5
    }
}

user_id = "user123"

condition_expression = "UserId = :user_id"
# Create the policy_statement dictionary
# Your code here

Hint

Use a dictionary with keys Effect, Action, Resource, and Condition to define the policy statement.

Practice

1. What is the main purpose of using Condition Keys in DynamoDB for row-level security?

easy

A. To encrypt data at rest in the database

B. To speed up query performance by indexing rows

C. To backup data automatically to another region

D. To control access by checking each row's attribute against user values

Solution

1. Step 1: Understand Condition Keys role

   Condition keys are used to compare row data with user attributes to decide access.

2. Step 2: Identify main purpose

   This comparison controls which rows a user can read or write, ensuring security.

3. Final Answer:

   To control access by checking each row's attribute against user values -> Option D

4. Quick Check:

   Condition keys = control access per row [OK]

Hint: Condition keys compare row data to user info for access [OK]

Common Mistakes:

• Confusing condition keys with indexing
• Thinking condition keys handle encryption
• Assuming condition keys backup data

2. Which of the following is the correct syntax to use a condition key in a DynamoDB policy to allow access only if the userId attribute matches the requester's ID?

easy

A. "Condition": {"StringEquals": {"dynamodb:LeadingKeys": "${aws:userid}"}}

B. "Condition": {"StringEquals": {"dynamodb:Attributes.userId": "${aws:userid}"}}

C. "Condition": {"StringEquals": {"dynamodb:LeadingKeys": "${aws:username}"}}

D. "Condition": {"StringEquals": {"dynamodb:Attributes.userId": "${aws:username}"}}

Solution

1. Step 1: Identify correct condition key for partition key

   "dynamodb:LeadingKeys" is used to check the partition key value in policies.

2. Step 2: Match with user ID variable

   "${aws:userid}" is the correct variable for the requester's user ID.

3. Final Answer:

   "Condition": {"StringEquals": {"dynamodb:LeadingKeys": "${aws:userid}"}} -> Option A

4. Quick Check:

   LeadingKeys with aws:userid = correct syntax [OK]

Hint: Use dynamodb:LeadingKeys for partition key in condition [OK]

Common Mistakes:

• Using dynamodb:Attributes instead of LeadingKeys for partition key
• Mixing aws:username with userId variable
• Incorrect JSON structure in condition

3. Given a DynamoDB table with partition key userId and a policy condition: "Condition": {"StringEquals": {"dynamodb:LeadingKeys": "123"}}, what will happen if a user with ID 123 tries to read a row with userId = 123?

medium

A. Access is allowed because the condition matches the partition key

B. Access is denied because the condition only checks sort keys

C. Access is allowed for all rows regardless of userId

D. Access is denied because the condition key is invalid

Solution

1. Step 1: Understand the condition key usage

   The condition checks if the partition key (userId) equals "123".

2. Step 2: Match user ID with row key

   The user ID is "123" and the row's userId is also "123", so condition passes.

3. Final Answer:

   Access is allowed because the condition matches the partition key -> Option A

4. Quick Check:

   Matching LeadingKeys value = access allowed [OK]

Hint: Condition matches partition key value means access allowed [OK]

Common Mistakes:

• Thinking condition checks sort key only
• Assuming condition key is invalid syntax
• Believing access is always denied without extra permissions

4. You wrote this condition in your DynamoDB policy: "Condition": {"StringEquals": {"dynamodb:LeadingKeys": "${aws:userid}"}}. But users report they cannot access their own rows. What is the likely problem?

medium

A. The variable ${aws:userid} is incorrect; it should be ${aws:username}

B. The condition key dynamodb:LeadingKeys only works with sort keys, not partition keys

C. The variable ${aws:userid} might not match the actual partition key values stored

D. The policy is missing the action permission for reading items

Solution

1. Step 1: Check variable correctness

   ${aws:userid} is a valid variable but must match stored partition key values exactly.

2. Step 2: Consider data mismatch

   If stored userId values differ in format or case, condition fails and denies access.

3. Final Answer:

   The variable ${aws:userid} might not match the actual partition key values stored -> Option C

4. Quick Check:

   Mismatch between variable and stored keys = access denied [OK]

Hint: Ensure variable matches stored partition key exactly [OK]

Common Mistakes:

• Assuming aws:userid is always wrong
• Confusing partition and sort keys in condition
• Ignoring missing action permissions

5. You want to enforce row-level security so that users can only update their own items in a DynamoDB table with partition key userId and sort key itemId. Which condition key setup correctly enforces this in an IAM policy?

hard

A. "Condition": {"StringEquals": {"dynamodb:LeadingKeys": "${aws:userid}"}}

B. "Condition": {"StringEquals": {"dynamodb:LeadingKeys": ["${aws:userid}", "${aws:itemid}"]}}

C. "Condition": {"StringEquals": {"dynamodb:Attributes.userId": "${aws:userid}", "dynamodb:Attributes.itemId": "${aws:itemid}"}}

D. "Condition": {"ForAllValues:StringEquals": {"dynamodb:LeadingKeys": "${aws:userid}"}}

Solution

1. Step 1: Understand table keys

   Partition key userId determines ownership; sort key itemId identifies specific items within a user's partition.

2. Step 2: Identify correct condition

   StringEquals on dynamodb:LeadingKeys with an array of [${aws:userid}, ${aws:itemid}] checks both partition and sort keys match, enforcing row-level security for specific items.

3. Final Answer:

   "Condition": {"StringEquals": {"dynamodb:LeadingKeys": ["${aws:userid}", "${aws:itemid}"]}} -> Option B

4. Quick Check:

   StringEquals dynamodb:LeadingKeys with array = partition and sort key match [OK]

Hint: Use array in dynamodb:LeadingKeys to match partition and sort keys [OK]

Common Mistakes:

• Using dynamodb:Attributes for primary key value checks
• Applying ForAllValues:StringEquals which mismatches sort key
• Using single string instead of array for both keys