IAM security policies with PartiQL for DynamoDB
The following permissions are required:
-
To read items using PartiQL for DynamoDB, you must have
dynamodb:PartiQLSelectpermission on the table or index. -
To insert items using PartiQL for DynamoDB, you must have
dynamodb:PartiQLInsertpermission on the table or index. -
To update items using PartiQL for DynamoDB, you must have
dynamodb:PartiQLUpdatepermission on the table or index. -
To delete items using PartiQL for DynamoDB, you must have
dynamodb:PartiQLDeletepermission on the table or index.
Example: Allow all PartiQL for DynamoDB statements (Select/Insert/Update/Delete) on a table
The following IAM policy grants permissions to run all PartiQL for DynamoDB statements on a table.
Example: Allow PartiQL for DynamoDB select statements on a table
The following IAM policy grants permissions to run the select
statement on a specific table.
Example: Allow PartiQL for DynamoDB insert statements on an index
The following IAM policy grants permissions to run the insert
statement on a specific index.
Example: Allow PartiQL for DynamoDB transactional statements only on a table
The following IAM policy grants permissions to run only transactional statements on a specific table.
Example: Allow PartiQL for DynamoDB non-transactional reads and writes and block PartiQL transactional reads and writes transactional statements on a table.
The following IAM policy grants permissions to run PartiQL for DynamoDB non-transactional reads and writes while blocking PartiQL for DynamoDB transactional reads and writes.
Example: Allow select statements and deny full table scan statements in PartiQL for DynamoDB
The following IAM policy grants permissions to run the select
statement on a specific table while blocking select statements that result in a full table scan.
