Error: failed to list tables not authorized dynamodb

A ListTables access-denied error means the caller cannot enumerate tables. Permission to read a particular table does not automatically grant dynamodb:ListTables.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "dynamodb:ListTables",
    "Resource": "*"
  }]
}

ListTables does not support an individual table ARN as its resource scope, so this action uses Resource: "*". Keep data-reading and writing permissions in separate statements scoped to the intended tables.

1. Identify the runtime user or role and attach the policy there. For Lambda this is its execution role.
2. Check permissions boundaries, session policies, organization controls and endpoint policies if an Allow is already present.
3. Retry in the intended Region. ListTables enumerates that account and Region, and an empty list is not an authorization failure.

An application with a known table name may not need to enumerate tables at all. Removing unnecessary discovery avoids granting permissions that the workload does not use.

See IAM guidance and AWS documentation.