Condition keys for row-level security in DynamoDB - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to allow access only if the partition key matches the user's ID.

DynamoDB

"ConditionExpression": "[1] = :userId"

Drag options to blanks, or click blank then click option'

AuserId

BpartitionKey

CsortKey

Dattribute_exists

Attempts:

3 left

💡 Hint

Common Mistakes

Using attribute_exists instead of the partition key.

Using sortKey when only partitionKey is needed.

The partition key is used to identify the row uniquely. Using it in the condition ensures row-level security.

2fill in blank

medium

Complete the condition to check if the user's role attribute equals 'admin'.

DynamoDB

"ConditionExpression": "[1] = :adminRole"

Drag options to blanks, or click blank then click option'

Arole

Buser_type

CuserRole

DaccessLevel

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'userRole' which might not exist.

Using 'accessLevel' which is not the attribute name.

The attribute 'role' is commonly used to store user roles like 'admin'.

3fill in blank

hard

Fix the error in the condition expression to check if the attribute 'status' is 'active'.

DynamoDB

"ConditionExpression": "[1] = :activeStatus"

Drag options to blanks, or click blank then click option'

Astatus

BStatus

Cattribute_exists(status)

Dstatus = active

Attempts:

3 left

💡 Hint

Common Mistakes

Using capitalized 'Status' which is incorrect.

Using 'attribute_exists' which checks presence, not value.

The attribute name is case-sensitive and should be exactly 'status'.

4fill in blank

hard

Fill both blanks to allow access only if the partition key matches and the user role is 'editor'.

DynamoDB

"ConditionExpression": "[1] = :userId AND [2] = :editorRole"

Drag options to blanks, or click blank then click option'

ApartitionKey

BuserId

Crole

DuserRole

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'userId' as the key instead of 'partitionKey'.

Using 'userRole' instead of 'role' for the role attribute.

The partition key ensures row-level access, and 'role' checks the user's role.

5fill in blank

hard

Fill all three blanks to restrict access where partition key matches, role is 'viewer', and status is 'active'.

DynamoDB

"ConditionExpression": "[1] = :userId AND [2] = :viewerRole AND [3] = :activeStatus"

Drag options to blanks, or click blank then click option'

ApartitionKey

Brole

Cstatus

DuserId

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up 'userId' with 'partitionKey'.

Using 'userId' in place of 'role' or 'status'.

Use 'partitionKey' for row identity, 'role' for user role, and 'status' for active status check.

Practice

1. What is the main purpose of using Condition Keys in DynamoDB for row-level security?

easy

A. To encrypt data at rest in the database

B. To speed up query performance by indexing rows

C. To backup data automatically to another region

D. To control access by checking each row's attribute against user values

Solution

1. Step 1: Understand Condition Keys role

   Condition keys are used to compare row data with user attributes to decide access.

2. Step 2: Identify main purpose

   This comparison controls which rows a user can read or write, ensuring security.

3. Final Answer:

   To control access by checking each row's attribute against user values -> Option D

4. Quick Check:

   Condition keys = control access per row [OK]

Hint: Condition keys compare row data to user info for access [OK]

Common Mistakes:

• Confusing condition keys with indexing
• Thinking condition keys handle encryption
• Assuming condition keys backup data

2. Which of the following is the correct syntax to use a condition key in a DynamoDB policy to allow access only if the userId attribute matches the requester's ID?

easy

A. "Condition": {"StringEquals": {"dynamodb:LeadingKeys": "${aws:userid}"}}

B. "Condition": {"StringEquals": {"dynamodb:Attributes.userId": "${aws:userid}"}}

C. "Condition": {"StringEquals": {"dynamodb:LeadingKeys": "${aws:username}"}}

D. "Condition": {"StringEquals": {"dynamodb:Attributes.userId": "${aws:username}"}}

Solution

1. Step 1: Identify correct condition key for partition key

   "dynamodb:LeadingKeys" is used to check the partition key value in policies.

2. Step 2: Match with user ID variable

   "${aws:userid}" is the correct variable for the requester's user ID.

3. Final Answer:

   "Condition": {"StringEquals": {"dynamodb:LeadingKeys": "${aws:userid}"}} -> Option A

4. Quick Check:

   LeadingKeys with aws:userid = correct syntax [OK]

Hint: Use dynamodb:LeadingKeys for partition key in condition [OK]

Common Mistakes:

• Using dynamodb:Attributes instead of LeadingKeys for partition key
• Mixing aws:username with userId variable
• Incorrect JSON structure in condition

3. Given a DynamoDB table with partition key userId and a policy condition: "Condition": {"StringEquals": {"dynamodb:LeadingKeys": "123"}}, what will happen if a user with ID 123 tries to read a row with userId = 123?

medium

A. Access is allowed because the condition matches the partition key

B. Access is denied because the condition only checks sort keys

C. Access is allowed for all rows regardless of userId

D. Access is denied because the condition key is invalid

Solution

1. Step 1: Understand the condition key usage

   The condition checks if the partition key (userId) equals "123".

2. Step 2: Match user ID with row key

   The user ID is "123" and the row's userId is also "123", so condition passes.

3. Final Answer:

   Access is allowed because the condition matches the partition key -> Option A

4. Quick Check:

   Matching LeadingKeys value = access allowed [OK]

Hint: Condition matches partition key value means access allowed [OK]

Common Mistakes:

• Thinking condition checks sort key only
• Assuming condition key is invalid syntax
• Believing access is always denied without extra permissions

4. You wrote this condition in your DynamoDB policy: "Condition": {"StringEquals": {"dynamodb:LeadingKeys": "${aws:userid}"}}. But users report they cannot access their own rows. What is the likely problem?

medium

A. The variable ${aws:userid} is incorrect; it should be ${aws:username}

B. The condition key dynamodb:LeadingKeys only works with sort keys, not partition keys

C. The variable ${aws:userid} might not match the actual partition key values stored

D. The policy is missing the action permission for reading items

Solution

1. Step 1: Check variable correctness

   ${aws:userid} is a valid variable but must match stored partition key values exactly.

2. Step 2: Consider data mismatch

   If stored userId values differ in format or case, condition fails and denies access.

3. Final Answer:

   The variable ${aws:userid} might not match the actual partition key values stored -> Option C

4. Quick Check:

   Mismatch between variable and stored keys = access denied [OK]

Hint: Ensure variable matches stored partition key exactly [OK]

Common Mistakes:

• Assuming aws:userid is always wrong
• Confusing partition and sort keys in condition
• Ignoring missing action permissions

5. You want to enforce row-level security so that users can only update their own items in a DynamoDB table with partition key userId and sort key itemId. Which condition key setup correctly enforces this in an IAM policy?

hard

A. "Condition": {"StringEquals": {"dynamodb:LeadingKeys": "${aws:userid}"}}

B. "Condition": {"StringEquals": {"dynamodb:LeadingKeys": ["${aws:userid}", "${aws:itemid}"]}}

C. "Condition": {"StringEquals": {"dynamodb:Attributes.userId": "${aws:userid}", "dynamodb:Attributes.itemId": "${aws:itemid}"}}

D. "Condition": {"ForAllValues:StringEquals": {"dynamodb:LeadingKeys": "${aws:userid}"}}

Solution

1. Step 1: Understand table keys

   Partition key userId determines ownership; sort key itemId identifies specific items within a user's partition.

2. Step 2: Identify correct condition

   StringEquals on dynamodb:LeadingKeys with an array of [${aws:userid}, ${aws:itemid}] checks both partition and sort keys match, enforcing row-level security for specific items.

3. Final Answer:

   "Condition": {"StringEquals": {"dynamodb:LeadingKeys": ["${aws:userid}", "${aws:itemid}"]}} -> Option B

4. Quick Check:

   StringEquals dynamodb:LeadingKeys with array = partition and sort key match [OK]

Hint: Use array in dynamodb:LeadingKeys to match partition and sort keys [OK]

Common Mistakes:

• Using dynamodb:Attributes for primary key value checks
• Applying ForAllValues:StringEquals which mismatches sort key
• Using single string instead of array for both keys