DynamoDB Access Control - The Ultimate Guide

Accessing DynamoDB is a bit different than with traditional databases. Most of us are probably accustomed to long-lived connections to SQL databases authenticated using username and password combination. DynamoDB is different. In this article we'll try to cover that.

Access Control & DynamoDB Security Best Pratices

Access to DynamoDB is secured using IAM (Identity and Access Management). This means, you need a valid AWS Identity to authenticate your requests and that identity must have sufficient permissions to create or access DynamoDB resources. Authentication in AWS can be achieved in a number of ways:

• using AWS account root from the AWS console or using pair of access and secret keys
• using IAM user from the AWS console or using pair of access and secret keys
• using IAM role which is attached to a IAM user to AWS resource, such as AWS Lambda function or EC2 instance
• using AWS Vault, an open-source tool which issues temporary credentials from long lived IAM identities stored securely on your machine
• using AWS SSO, a cloud service that allows you to grant your users access to AWS resources

How to Give Lambda Access to DynamoDB

Using Console

First, open Lambda which should have an access to the DynamoDB and head to "Permissions" tab. On that tab, click "View Role Document".

An editor should popup. Add following inline policy to the policies array:

{
    "document": {
        "Version": "2012-10-17",
        "Statement": [
            {
            "Action": [
                "dynamodb:*"
            ],
            "Resource": "arn:aws:dynamodb:<region>:<account-id>:table/<table-name>",
            "Effect": "Allow"
            }
        ]
    },
    "name": "my_table_access_iam_policy",
    "type": "inline"
},
{
    "document": {
        "Version": "2012-10-17",
        "Statement": [
            {
            "Action": [
                "dynamodb:*"
            ],
            "Resource": "arn:aws:dynamodb:<region>:<account-id>:table/<table-name>",
            "Effect": "Allow"
            }
        ]
    },
    "name": "my_table_access_iam_policy",
    "type": "inline"
},

It will give Lambda admin permissions to <table-name>.

Using Serverless Framework

Adding IAM permissions to your Lambda functions in Serverless is as easy as extending provider.iamRoleStatements object like so:

provider:
  name: aws
  runtime: nodejs12.x
  iamRoleStatements: # permissions for all of your functions can be set here
    - Effect: Allow
      Action: # Gives permission to DynamoDB tables in a specific region
        - dynamodb:DescribeTable
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
      Resource: "arn:aws:dynamodb:us-east-1:*:*"
provider:
  name: aws
  runtime: nodejs12.x
  iamRoleStatements: # permissions for all of your functions can be set here
    - Effect: Allow
      Action: # Gives permission to DynamoDB tables in a specific region
        - dynamodb:DescribeTable
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
      Resource: "arn:aws:dynamodb:us-east-1:*:*"

How to Access DynamoDB From EC2

Accessing DynamoDB from EC2 instance can be achieved in two ways:

• Using Access and Secret keys. AWS SDK or CLI will use a pair of strings stored in ~/.aws directory or using environment variables. This method is not recommended as it is a security risk
• Using IAM role. This is the preferred way where your instance gets an IAM role assigned and uses it to do actions against AWS resources. More on that here

AWS IAM & DynamoDB Read-Only Policy

If you want to give your teammates a read-only access to the databases, you can use following IAM Policy:

{
    "Version": "2012-10-17",
    "Statement": [
         {
            "Sid": "DynamoDBListTables",
            "Effect": "Allow",
            "Action": [
                "dynamodb:ListTables"
            ],
            "Resource": "*"
        },
        {
            "Sid": "DynamoDBTableReadOnly",
            "Effect": "Allow",
            "Action": [
                "dynamodb:DescribeTable",
                "dynamodb:Query",
                "dynamodb:Scan",
                "dynamodb:GetItem",
                "dynamodb:BatchGetItem"
            ],
            "Resource": "arn:aws:dynamodb:<region>:<account-id>:table/<table-name>"
        }
    ]
}
{
    "Version": "2012-10-17",
    "Statement": [
         {
            "Sid": "DynamoDBListTables",
            "Effect": "Allow",
            "Action": [
                "dynamodb:ListTables"
            ],
            "Resource": "*"
        },
        {
            "Sid": "DynamoDBTableReadOnly",
            "Effect": "Allow",
            "Action": [
                "dynamodb:DescribeTable",
                "dynamodb:Query",
                "dynamodb:Scan",
                "dynamodb:GetItem",
                "dynamodb:BatchGetItem"
            ],
            "Resource": "arn:aws:dynamodb:<region>:<account-id>:table/<table-name>"
        }
    ]
}

It will allow them to list all of the tables in the AWS account but read the data only from <table-name> table.

Understanding DynamoDB Fine Grained Control

Fine-Grained Access Control for DynamoDB allows you to restrict access to some rows and columns in the table using IAM policies. It can be useful for:

• A multiplayer game table which stores High-scores in the table. You want to display users scores and their nicknames but probably not want to expose their emails. In case like this one, "Vertical" IAM Condition let you selectively hide specific attributes of all of the DynamoDB items in a particular table by matching on attribute names.
• Metadata store. You probably won't like to expose all the records to every user, only the he's the owner of. In case like this one, "Horizontal" IAM Condition let you selectively show only specific records.

More on that on official AWS blog.

Permissions required by Dynobase for DynamoDB

Dynobase can be used with DynamoDB in two modes - read-only or read-write**.

To use Dynobase in read-only mode, make sure to give your role/policy following permissions:

- sts:GetCallerIdentity
- dynamodb:ListTables
- dynamodb:DescribeTable
- dynamodb:GetItem
- dynamodb:Query
- dynamodb:Scan
- sts:GetCallerIdentity
- dynamodb:ListTables
- dynamodb:DescribeTable
- dynamodb:GetItem
- dynamodb:Query
- dynamodb:Scan

If you want to be able to make data modifications through Dynobase, include also following IAM actions:

- dynamodb:DeleteItem
- dynamodb:PutItem
- dynamodb:UpdateItem
- dynamodb:BatchWriteItem
- dynamodb:PartiQL*
- dynamodb:DeleteItem
- dynamodb:PutItem
- dynamodb:UpdateItem
- dynamodb:BatchWriteItem
- dynamodb:PartiQL*