Error: accessdeniedexception dynamodb

AccessDeniedException means the effective permissions of the caller do not allow the DynamoDB operation. Read the denied action and resource ARN in the error before editing policies.

1. Identify the actual role or user. For Lambda, inspect its execution role; a developer's console permissions do not transfer to the function.
2. Allow only the required actions on the intended table and, for index queries, the index ARN.
3. Check identity policies, resource policies, session policies, permissions boundaries, organization policies and VPC endpoint policies for restrictive conditions or explicit denies.
4. For cross-account access, review both the caller permissions and the resource policy. An additional Allow cannot override an explicit Deny.

Example for querying Orders and its indexes and updating Orders items:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "dynamodb:Query",
      "Resource": ["arn:aws:dynamodb:us-east-1:123456789012:table/Orders",
        "arn:aws:dynamodb:us-east-1:123456789012:table/Orders/index/*"] },
    { "Effect": "Allow", "Action": "dynamodb:UpdateItem",
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders" }
  ]
}

Replace the example account, Region and resource names. A KMS denial requires checking the encryption key policy too.

See access-control guidance and AWS documentation.