Why IAM policies protect data in DynamoDB - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

How IAM policies control access to DynamoDB data

Which statement best explains how IAM policies protect data in DynamoDB?

A IAM policies back up DynamoDB data regularly to protect against data loss.

B IAM policies automatically encrypt all data stored in DynamoDB tables without user configuration.

C IAM policies define who can access DynamoDB tables and what actions they can perform, preventing unauthorized data access.

D IAM policies monitor network traffic to detect unauthorized access attempts to DynamoDB.

💡 Hint

Think about how permissions control user actions on data.

IAM policies specify permissions for users and roles, controlling who can read, write, or delete data in DynamoDB. This prevents unauthorized users from accessing or modifying data.

❓ query_result

intermediate

Effect of missing IAM permission on DynamoDB query

Given a user without the dynamodb:Query permission on a table, what will happen when they try to run a query?

DynamoDB

aws dynamodb query --table-name Customers --key-condition-expression "CustomerId = :id" --expression-attribute-values '{":id":{"S":"123"}}'

A The query fails with an AccessDeniedException error.

B The query runs successfully and returns matching items.

C The query returns an empty result set without error.

D The query runs but only returns partial data.

💡 Hint

Consider what happens if permissions are missing for an action.

Without the dynamodb:Query permission, the request is denied and AWS returns an AccessDeniedException error, preventing unauthorized data access.

📝 Syntax

advanced

Identify the correct IAM policy statement to allow reading from a DynamoDB table

Which IAM policy statement correctly allows a user to read items from the DynamoDB table named Orders?

DynamoDB

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "dynamodb:GetItem",
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
    }
  ]
}

A

{
  "Effect": "Deny",
  "Action": "dynamodb:GetItem",
  "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
}

B

{
  "Effect": "Allow",
  "Action": "dynamodb:PutItem",
  "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
}

C

{
  "Effect": "Allow",
  "Action": "dynamodb:DeleteItem",
  "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
}

D

{
  "Effect": "Allow",
  "Action": "dynamodb:GetItem",
  "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
}

💡 Hint

Look for the action that reads data and the effect that allows it.

The dynamodb:GetItem action allows reading a single item from the table. The effect must be Allow to grant permission.

❓ optimization

advanced

Optimizing IAM policies for least privilege on DynamoDB

You want to grant a user permission to only update the Status attribute of items in the Shipments table. Which IAM policy approach best follows the principle of least privilege?

A Allow <code>dynamodb:UpdateItem</code> on the <code>Shipments</code> table with a condition restricting updates to the <code>Status</code> attribute only.

B Allow all DynamoDB actions on the <code>Shipments</code> table.

C Allow <code>dynamodb:PutItem</code> on the <code>Shipments</code> table.

D Allow <code>dynamodb:UpdateItem</code> on the entire <code>Shipments</code> table without conditions.

💡 Hint

Think about limiting permissions to only what is necessary.

Using a condition to restrict updates to only the Status attribute ensures the user cannot modify other data, following least privilege.

🔧 Debug

expert

Diagnose why an IAM policy does not allow reading from DynamoDB

A user has this IAM policy but cannot read items from the Inventory table. What is the most likely reason?

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["dynamodb:Scan"],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Inventory"
    }
  ]
}

A The Resource ARN is incorrect and does not match the Inventory table.

B The policy only allows Scan, but the user is trying to use GetItem or Query which are not allowed.

C The Effect should be Deny instead of Allow to permit access.

D The policy is missing the version date, so it is invalid.

💡 Hint

Check which actions the policy allows versus what the user tries to do.

The policy only permits the Scan action. If the user tries to perform GetItem or Query, those actions are denied because they are not included in the policy.