Error: is not authorized to perform dynamodb:* on resource

is not authorized to perform dynamodb:... identifies an action the caller cannot perform on the specified resource. The fix is to correct effective permissions for the principal in the error, rather than adding unrestricted dynamodb:* access.

Find the role making the call

For Lambda, inspect the execution role configured on the function. For local code, compare the selected profile with aws sts get-caller-identity. A role assumed by the application can differ from your interactive identity.

Choose the permission scope

Attach an appropriate customer managed policy or an inline policy to that role. Managed policies are reusable across roles; inline policies are tied to one identity. Review broad AWS managed policies before using them for application access. The deprecated AmazonDynamoDBFullAccess policy is not a reason to grant full access to a runtime.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "dynamodb:Query",
    "Resource": [
      "arn:aws:dynamodb:us-east-1:123456789012:table/Orders",
      "arn:aws:dynamodb:us-east-1:123456789012:table/Orders/index/CustomerIndex"
    ]
  }]
}

Replace the account, Region, table and index. This example grants Query, not Scan, writes or table creation. Review the policy and attach it to the execution role, then retry the same operation.

If the denial remains

Check explicit denies and conditions in identity policies, the table resource policy, permissions boundaries, session policies, organization policies and endpoint policies. Cross-account access needs authorization on both sides. A KMS error also requires reviewing the key policy. Adding an Allow does not override a Deny.

See Lambda DynamoDB permissions and AWS documentation.