Why IAM policies protect data in DynamoDB - See It in Action

Why IAM Policies Protect Data in DynamoDB

📖 Scenario: You are managing a DynamoDB table that stores customer orders for an online store. You want to make sure only authorized users can read or write data to this table.

🎯 Goal: Build a simple IAM policy that controls access to a DynamoDB table called Orders. This policy will protect the data by allowing only specific actions.

📋 What You'll Learn

Create a JSON object representing an IAM policy

Include a policy Version and Statement array

Add a statement that allows dynamodb:GetItem and dynamodb:PutItem actions

Restrict the policy to the Orders table ARN

Add a condition to allow access only if the request comes from a specific AWS account ID

💡 Why This Matters

🌍 Real World

IAM policies are essential for securing data in cloud databases by controlling who can read or write data.

💼 Career

Understanding IAM policies is critical for cloud administrators and developers to protect sensitive data and comply with security standards.

1

Create the basic IAM policy structure

Create a variable called iam_policy and assign it a dictionary with the key Version set to "2012-10-17" and an empty list for the key Statement.

DynamoDB

iam_policy = {
    "Version": "2012-10-17",
    "Statement": []
}
# Your code here

Hint

The policy needs a version and a place to add statements.

2

Add a statement to allow read and write actions

Add a dictionary to the Statement list in iam_policy with the keys: Effect set to "Allow", Action set to a list containing "dynamodb:GetItem" and "dynamodb:PutItem", and Resource set to the string "arn:aws:dynamodb:us-east-1:123456789012:table/Orders".

DynamoDB

iam_policy = {
    "Version": "2012-10-17",
    "Statement": [
        # Add the statement dictionary here
    ]
}
# Your code here

Hint

The statement must allow specific actions on the Orders table.

3

Add a condition to restrict access by AWS account ID

Inside the statement dictionary in iam_policy["Statement"], add a Condition key with a dictionary that uses StringEquals to restrict aws:PrincipalAccount to "123456789012".

DynamoDB

iam_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["dynamodb:GetItem", "dynamodb:PutItem"],
            "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders",
            # Add the Condition dictionary here
        }
    ]
}
# Your code here

Hint

The condition limits access to a specific AWS account.

4

Complete the IAM policy with all parts combined

Ensure the iam_policy variable contains the full dictionary with Version, one Statement that has Effect, Action, Resource, and Condition restricting access to the Orders table for AWS account 123456789012.

DynamoDB

iam_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["dynamodb:GetItem", "dynamodb:PutItem"],
            "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders",
            "Condition": {
                "StringEquals": {
                    "aws:PrincipalAccount": "123456789012"
                }
            }
        }
    ]
}
# Your code here

Hint

Review all parts to make sure the policy is complete and correct.

Practice

1. What is the main purpose of IAM policies in DynamoDB?

easy

A. To speed up database queries

B. To create database tables

C. To store data backups automatically

D. To control who can access and modify data

Solution

1. Step 1: Understand IAM policy role

   IAM policies define permissions for users and services to access AWS resources.

2. Step 2: Connect IAM policies to data protection

   By controlling who can read or write data, IAM policies protect the data from unauthorized access.

3. Final Answer:

   To control who can access and modify data -> Option D

4. Quick Check:

   IAM policies = control access [OK]

Hint: IAM policies control access rights to data [OK]

Common Mistakes:

• Thinking IAM speeds up queries
• Confusing IAM with data backup
• Believing IAM creates tables

2. Which of the following is a correct part of an IAM policy JSON for DynamoDB?

easy

A. {\"Effect\": \"Allow\", \"Action\": \"dynamodb:PutItem\", \"Resource\": \"arn:aws:dynamodb:region:account-id:table/TableName\"}

B. {\"Effect\": \"Deny\", \"Action\": \"dynamodb:DeleteTable\", \"Resource\": \"arn:aws:s3:::bucket-name\"}

C. {\"Effect\": \"Allow\", \"Action\": \"s3:PutObject\", \"Resource\": \"arn:aws:dynamodb:region:account-id:table/TableName\"}

D. {\"Effect\": \"Allow\", \"Action\": \"dynamodb:Query\", \"Resource\": \"arn:aws:dynamodb:region:account-id:table/\"}

Solution

1. Step 1: Check action and resource match

   {\"Effect\": \"Allow\", \"Action\": \"dynamodb:PutItem\", \"Resource\": \"arn:aws:dynamodb:region:account-id:table/TableName\"} correctly allows the PutItem action on a DynamoDB table resource ARN.

2. Step 2: Identify incorrect resource or action in others

   {\"Effect\": \"Deny\", \"Action\": \"dynamodb:DeleteTable\", \"Resource\": \"arn:aws:s3:::bucket-name\"} uses an S3 bucket ARN with a DynamoDB action, {\"Effect\": \"Allow\", \"Action\": \"s3:PutObject\", \"Resource\": \"arn:aws:dynamodb:region:account-id:table/TableName\"} mixes S3 action with DynamoDB resource, {\"Effect\": \"Allow\", \"Action\": \"dynamodb:Query\", \"Resource\": \"arn:aws:dynamodb:region:account-id:table/\"} has incomplete resource ARN.

3. Final Answer:

   Correct IAM policy JSON for DynamoDB PutItem -> Option A

4. Quick Check:

   Action and resource must match service [OK]

Hint: Match Action and Resource service in IAM JSON [OK]

Common Mistakes:

• Using wrong ARN for resource
• Mixing actions from different AWS services
• Leaving resource ARN incomplete

3. Given this IAM policy snippet, what will happen if a user tries to delete an item from the DynamoDB table?

{
  "Effect": "Deny",
  "Action": "dynamodb:DeleteItem",
  "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
}

medium

A. The user can delete items normally

B. The policy has no effect on delete actions

C. The user is denied permission to delete items

D. The user can delete items only if they own them

Solution

1. Step 1: Understand the Effect field

   The policy has Effect set to Deny, which blocks the specified action.

2. Step 2: Check the Action and Resource

   The action dynamodb:DeleteItem on the Orders table is denied, so the user cannot delete items there.

3. Final Answer:

   The user is denied permission to delete items -> Option C

4. Quick Check:

   Effect Deny blocks action [OK]

Hint: Effect Deny always blocks the action [OK]

Common Mistakes:

• Assuming Deny means allow
• Ignoring the resource ARN
• Thinking ownership affects this policy

4. A developer wrote this IAM policy to allow reading from a DynamoDB table but it doesn't work:

{
  "Effect": "Allow",
  "Action": "dynamodb:GetItem",
  "Resource": "arn:aws:dynamodb:us-west-2:123456789012:table"
}

What is the error?

medium

A. The Action dynamodb:GetItem is invalid

B. The Resource ARN is incomplete; it must specify the table name

C. Effect should be Deny to allow access

D. The policy must include a Condition block

Solution

1. Step 1: Check the Resource ARN format

   The ARN ends with :table but lacks the specific table name, so it is incomplete.

2. Step 2: Understand ARN requirements for DynamoDB

   IAM policies require full ARN including the table name to apply permissions correctly.

3. Final Answer:

   The Resource ARN is incomplete; it must specify the table name -> Option B

4. Quick Check:

   Complete ARN needed for resource [OK]

Hint: Always include full table name in ARN [OK]

Common Mistakes:

• Leaving ARN incomplete
• Confusing Allow and Deny effects
• Thinking Condition is mandatory

5. You want to protect sensitive data in your DynamoDB table by allowing only users with a specific IAM role to update items. Which approach best uses IAM policies to achieve this?

hard

A. Create an IAM policy that allows dynamodb:UpdateItem only for the role's ARN on the table resource

B. Grant all users dynamodb:UpdateItem permission and rely on application code to check roles

C. Use a policy that denies dynamodb:UpdateItem for everyone except the root user

D. Create a policy allowing dynamodb:UpdateItem on all tables for all users

Solution

1. Step 1: Identify the need for role-based permission

   Only users with a specific IAM role should update items, so permissions must be scoped to that role.

2. Step 2: Use IAM policy to allow UpdateItem only for that role on the table

   Creating a policy that allows dynamodb:UpdateItem only for the role's ARN on the table resource enforces this securely.

3. Final Answer:

   Create an IAM policy that allows dynamodb:UpdateItem only for the role's ARN on the table resource -> Option A

4. Quick Check:

   Role-based IAM policy controls updates [OK]

Hint: Scope permissions to specific role and resource [OK]

Common Mistakes:

• Relying on app code instead of IAM
• Using overly broad permissions
• Denying everyone except root is too restrictive