IAM policy for DynamoDB - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Which IAM policy allows full access to a specific DynamoDB table?

Given the following IAM policy, what is the effect on the DynamoDB table named OrdersTable?

DynamoDB

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "dynamodb:*",
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/OrdersTable"
    }
  ]
}

A Allows read-only actions on all DynamoDB tables in the account.

B Allows all DynamoDB actions on all tables in the us-east-1 region.

C Denies all actions on the OrdersTable.

D Allows all DynamoDB actions on the OrdersTable only.

💡 Hint

Look at the Action and Resource fields carefully.

The policy explicitly allows all DynamoDB actions (dynamodb:*) but only on the specified table resource ARN for OrdersTable.

❓ security

intermediate

Which IAM policy snippet restricts DynamoDB write actions but allows read actions on all tables?

Select the policy snippet that correctly restricts write actions (PutItem, UpdateItem, DeleteItem) but allows read actions (GetItem, Query, Scan) on all DynamoDB tables.

A

{
  "Effect": "Allow",
  "Action": ["dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan"],
  "Resource": "arn:aws:dynamodb:*:*:table/*"
}

B

{
  "Effect": "Deny",
  "Action": ["dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem"],
  "Resource": "arn:aws:dynamodb:*:*:table/*"
}

C

{
  "Effect": "Allow",
  "Action": "dynamodb:*",
  "Resource": "arn:aws:dynamodb:*:*:table/*"
}

D

{
  "Effect": "Allow",
  "Action": ["dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem"],
  "Resource": "arn:aws:dynamodb:*:*:table/*"
}

💡 Hint

Focus on which actions are allowed and which are denied.

Option A allows only read actions on all tables. Option A denies write actions but does not explicitly allow read actions, so it may block all actions if no other policy allows them.

❓ Architecture

advanced

What is the minimum IAM policy to allow a Lambda function to update items in a DynamoDB table named Users?

Choose the policy that grants only the necessary permissions for a Lambda function to update items in the DynamoDB table Users.

A

{
  "Effect": "Allow",
  "Action": "dynamodb:UpdateItem",
  "Resource": "arn:aws:dynamodb:us-west-2:123456789012:table/Users"
}

B

{
  "Effect": "Allow",
  "Action": "dynamodb:*",
  "Resource": "arn:aws:dynamodb:us-west-2:123456789012:table/Users"
}

C

{
  "Effect": "Allow",
  "Action": ["dynamodb:UpdateItem", "dynamodb:GetItem"],
  "Resource": "arn:aws:dynamodb:us-west-2:123456789012:table/Users"
}

D

{
  "Effect": "Allow",
  "Action": "dynamodb:UpdateItem",
  "Resource": "*"
}

💡 Hint

Minimal permissions mean only what is needed for update.

Option A grants only UpdateItem on the specific table, which is the minimum required. Option A grants all actions, which is more than needed. Option A adds GetItem unnecessarily. Option A grants UpdateItem on all resources, which is too broad.

✅ Best Practice

advanced

Which IAM policy practice improves security when granting DynamoDB access?

Select the best practice for writing IAM policies that grant access to DynamoDB tables.

A Grant full DynamoDB access (dynamodb:*) on all tables to reduce complexity.

B Grant access to DynamoDB tables using wildcard resource ARN like arn:aws:dynamodb:*:*:table/* for all users.

C Use resource-level permissions to restrict access to only required tables and actions.

D Avoid specifying resources and allow all actions globally for easier management.

💡 Hint

Think about the principle of least privilege.

Option C follows the principle of least privilege by restricting permissions to only necessary tables and actions, improving security.

🧠 Conceptual

expert

What error occurs if an IAM policy denies all DynamoDB actions but a user has a separate policy allowing GetItem on a table?

If a user has two IAM policies: one explicitly denies all DynamoDB actions, and another allows only GetItem on a specific table, what is the effective permission when the user tries to perform GetItem?

A The user can perform GetItem only if the deny policy is attached to a different user.

B The GetItem action is denied because explicit deny overrides allow.

C The user receives a syntax error due to conflicting policies.

D The GetItem action is allowed because explicit allow overrides deny.

💡 Hint

Remember how AWS IAM evaluates deny and allow statements.

In AWS IAM, explicit deny always overrides any allow. So even if one policy allows GetItem, the explicit deny on all DynamoDB actions blocks it.