Why IAM policies protect data in DynamoDB - Performance Analysis

Time Complexity: Why IAM policies protect data

O(n)

Understanding Time Complexity

We want to understand how the time it takes to check permissions grows as more users and policies are involved.

How does the system handle permission checks efficiently to protect data?

Scenario Under Consideration

Analyze the time complexity of checking IAM policies for a DynamoDB request.

// Simplified IAM policy check pseudocode
function checkAccess(user, action, resource) {
  for (const policy of user.policies) {
    if (policy.allows(action, resource)) {
      return true;
    }
  }
  return false;
}
    

This code checks each policy attached to a user to see if it allows the requested action on the resource.

Identify Repeating Operations

Look for repeated steps in the code.

• Primary operation: Looping through all policies attached to the user.
• How many times: Once for each policy the user has.

How Execution Grows With Input

As the number of policies grows, the time to check permissions grows too.

Input Size (number of policies)	Approx. Operations
10	10 checks
100	100 checks
1000	1000 checks

Pattern observation: The time grows directly with the number of policies to check.

Final Time Complexity

Time Complexity: O(n)

This means the time to check permissions grows linearly with the number of policies a user has.

Common Mistake

[X] Wrong: "Checking IAM policies is instant no matter how many policies exist."

[OK] Correct: Each policy must be checked one by one until a match is found, so more policies mean more checks and more time.

Interview Connect

Understanding how permission checks scale helps you explain how secure systems stay fast even as they grow.

Self-Check

"What if policies were indexed by action and resource? How would that change the time complexity?"

Practice

1. What is the main purpose of IAM policies in DynamoDB?

easy

A. To speed up database queries

B. To create database tables

C. To store data backups automatically

D. To control who can access and modify data

Solution

1. Step 1: Understand IAM policy role

   IAM policies define permissions for users and services to access AWS resources.

2. Step 2: Connect IAM policies to data protection

   By controlling who can read or write data, IAM policies protect the data from unauthorized access.

3. Final Answer:

   To control who can access and modify data -> Option D

4. Quick Check:

   IAM policies = control access [OK]

Hint: IAM policies control access rights to data [OK]

Common Mistakes:

• Thinking IAM speeds up queries
• Confusing IAM with data backup
• Believing IAM creates tables

2. Which of the following is a correct part of an IAM policy JSON for DynamoDB?

easy

A. {\"Effect\": \"Allow\", \"Action\": \"dynamodb:PutItem\", \"Resource\": \"arn:aws:dynamodb:region:account-id:table/TableName\"}

B. {\"Effect\": \"Deny\", \"Action\": \"dynamodb:DeleteTable\", \"Resource\": \"arn:aws:s3:::bucket-name\"}

C. {\"Effect\": \"Allow\", \"Action\": \"s3:PutObject\", \"Resource\": \"arn:aws:dynamodb:region:account-id:table/TableName\"}

D. {\"Effect\": \"Allow\", \"Action\": \"dynamodb:Query\", \"Resource\": \"arn:aws:dynamodb:region:account-id:table/\"}

Solution

1. Step 1: Check action and resource match

   {\"Effect\": \"Allow\", \"Action\": \"dynamodb:PutItem\", \"Resource\": \"arn:aws:dynamodb:region:account-id:table/TableName\"} correctly allows the PutItem action on a DynamoDB table resource ARN.

2. Step 2: Identify incorrect resource or action in others

   {\"Effect\": \"Deny\", \"Action\": \"dynamodb:DeleteTable\", \"Resource\": \"arn:aws:s3:::bucket-name\"} uses an S3 bucket ARN with a DynamoDB action, {\"Effect\": \"Allow\", \"Action\": \"s3:PutObject\", \"Resource\": \"arn:aws:dynamodb:region:account-id:table/TableName\"} mixes S3 action with DynamoDB resource, {\"Effect\": \"Allow\", \"Action\": \"dynamodb:Query\", \"Resource\": \"arn:aws:dynamodb:region:account-id:table/\"} has incomplete resource ARN.

3. Final Answer:

   Correct IAM policy JSON for DynamoDB PutItem -> Option A

4. Quick Check:

   Action and resource must match service [OK]

Hint: Match Action and Resource service in IAM JSON [OK]

Common Mistakes:

• Using wrong ARN for resource
• Mixing actions from different AWS services
• Leaving resource ARN incomplete

3. Given this IAM policy snippet, what will happen if a user tries to delete an item from the DynamoDB table?

{
  "Effect": "Deny",
  "Action": "dynamodb:DeleteItem",
  "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
}

medium

A. The user can delete items normally

B. The policy has no effect on delete actions

C. The user is denied permission to delete items

D. The user can delete items only if they own them

Solution

1. Step 1: Understand the Effect field

   The policy has Effect set to Deny, which blocks the specified action.

2. Step 2: Check the Action and Resource

   The action dynamodb:DeleteItem on the Orders table is denied, so the user cannot delete items there.

3. Final Answer:

   The user is denied permission to delete items -> Option C

4. Quick Check:

   Effect Deny blocks action [OK]

Hint: Effect Deny always blocks the action [OK]

Common Mistakes:

• Assuming Deny means allow
• Ignoring the resource ARN
• Thinking ownership affects this policy

4. A developer wrote this IAM policy to allow reading from a DynamoDB table but it doesn't work:

{
  "Effect": "Allow",
  "Action": "dynamodb:GetItem",
  "Resource": "arn:aws:dynamodb:us-west-2:123456789012:table"
}

What is the error?

medium

A. The Action dynamodb:GetItem is invalid

B. The Resource ARN is incomplete; it must specify the table name

C. Effect should be Deny to allow access

D. The policy must include a Condition block

Solution

1. Step 1: Check the Resource ARN format

   The ARN ends with :table but lacks the specific table name, so it is incomplete.

2. Step 2: Understand ARN requirements for DynamoDB

   IAM policies require full ARN including the table name to apply permissions correctly.

3. Final Answer:

   The Resource ARN is incomplete; it must specify the table name -> Option B

4. Quick Check:

   Complete ARN needed for resource [OK]

Hint: Always include full table name in ARN [OK]

Common Mistakes:

• Leaving ARN incomplete
• Confusing Allow and Deny effects
• Thinking Condition is mandatory

5. You want to protect sensitive data in your DynamoDB table by allowing only users with a specific IAM role to update items. Which approach best uses IAM policies to achieve this?

hard

A. Create an IAM policy that allows dynamodb:UpdateItem only for the role's ARN on the table resource

B. Grant all users dynamodb:UpdateItem permission and rely on application code to check roles

C. Use a policy that denies dynamodb:UpdateItem for everyone except the root user

D. Create a policy allowing dynamodb:UpdateItem on all tables for all users

Solution

1. Step 1: Identify the need for role-based permission

   Only users with a specific IAM role should update items, so permissions must be scoped to that role.

2. Step 2: Use IAM policy to allow UpdateItem only for that role on the table

   Creating a policy that allows dynamodb:UpdateItem only for the role's ARN on the table resource enforces this securely.

3. Final Answer:

   Create an IAM policy that allows dynamodb:UpdateItem only for the role's ARN on the table resource -> Option A

4. Quick Check:

   Role-based IAM policy controls updates [OK]

Hint: Scope permissions to specific role and resource [OK]

Common Mistakes:

• Relying on app code instead of IAM
• Using overly broad permissions
• Denying everyone except root is too restrictive