DynamoDB API Permissions: Actions, Resources, and Conditions Reference
When you are setting up Access Control and writing a permissions policy that you can attach to an IAM identity
(identity-based policies), you can use the following table
as a reference. The
table lists
each
DynamoDB API operation, the corresponding actions for which you can grant
permissions to perform the action, and the AWS resource for which you can grant the
permissions. You specify the actions in the policy's Action
field, and you
specify the resource value in the policy's Resource
field.
You can use AWS-wide condition keys in your DynamoDB policies to express conditions. For a complete list of AWS-wide keys, see Available Keys in the IAM User Guide.
In addition to the AWS-wide condition keys, DynamoDB has its own specific keys that you can use in conditions. For more information, see Using IAM Policy Conditions for Fine-Grained Access Control.
Note
To specify an action, use the dynamodb:
prefix followed by the API
operation name (for example, dynamodb:CreateTable
).
If you see an expand arrow (↗) in the upper-right corner of the table, you can open the table in a new window. To close the window, choose the close button (X) in the lower-right corner.
Amazon DynamoDB API and Required Permissions for Actions
DynamoDB API Operations | Required Permissions (API Actions) | Resources |
---|---|---|
BatchGetItem | dynamodb:BatchGetItem |
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
BatchWriteItem |
dynamodb:BatchWriteItem
|
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
CreateTable | dynamodb:CreateTable |
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
DeleteItem | dynamodb:DeleteItem |
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
DeleteTable |
dynamodb:DeleteTable
|
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
DescribeLimits | dynamodb:DescribeLimits | arn:aws:dynamodb: |
DescribeReservedCapacity | dynamodb:DescribeReservedCapacity | arn:aws:dynamodb: |
DescribeReservedCapacityOfferings | dynamodb:DescribeReservedCapacityOfferings | arn:aws:dynamodb: |
DescribeStream | dynamodb:DescribeStream |
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
DescribeTable | dynamodb:DescribeTable |
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
GetItem | dynamodb:GetItem |
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
GetRecords | dynamodb:GetRecords |
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
GetShardIterator | dynamodb:GetShardIterator | arn:aws:dynamodb:
or arn:aws:dynamodb: |
ListStreams | dynamodb:ListStreams |
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
ListTables | dynamodb:ListTables | *
|
ListTagsOfResource | dynamodb:ListTagsOfResource |
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
PurchaseReservedCapacityOfferings | dynamodb:PurchaseReservedCapacityOfferings | arn:aws:dynamodb: |
PutItem | dynamodb:PutItem |
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
Query | dynamodb:Query | To query a table: arn:aws:dynamodb: or: arn:aws:dynamodb: To query an index: arn:aws:dynamodb: or: arn:aws:dynamodb: |
Scan |
dynamodb:Scan
| To scan a table: arn:aws:dynamodb: or: arn:aws:dynamodb: To scan an index: arn:aws:dynamodb: or: arn:aws:dynamodb: |
TagResource |
dynamodb:TagResource
|
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
UpdateItem |
dynamodb:UpdateItem
|
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
UpdateTable |
dynamodb:UpdateTable
|
arn:aws:dynamodb:
or arn:aws:dynamodb:
|
UntagResource |
dynamodb:UntagResource
|
arn:aws:dynamodb:
or arn:aws:dynamodb:
|