Amazon DynamoDB: Allows item-level access to DynamoDB based on an Amazon Cognito ID - AWS Identity and Access Management

Amazon DynamoDB: Allows item-level access to DynamoDB based on an Amazon Cognito ID

This example shows how you might create an IAM policy that allows item-level access to the MyTable DynamoDB table based on an Amazon Cognito ID. This policy grants the permissions necessary to complete this action from the AWS API or AWS CLI only. To use this policy, replace the italicized placeholder text in the example policy with your own information. Then, follow the directions in create a policy or edit a policy.

To use this policy, you must structure your DynamoDB table so the Amazon Cognito user ID is the partition key. For more information, see Creating a Table in the Amazon DynamoDB Developer Guide.

To learn more about DynamoDB condition keys, see Specifying Conditions: Using Condition Keys in the Amazon DynamoDB Developer Guide.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:DeleteItem", "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query", "dynamodb:UpdateItem" ], "Resource": ["arn:aws:dynamodb:*:*:table/MyTable"], "Condition": { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["${cognito-identity.amazonaws.com:sub}"] } } } ] }