Actions, Resources, and Condition Keys for Amazon DynamoDB - AWS Identity and Access Management
Description: Lists all of the available service-specific resources, actions, and condition keys that can be used in IAM policies to control access to Amazon DynamoDB.
Keywords: IAM,AWS Identity and Access Management,IAM user,user,IAM group,group,IAM role,role,permission policy,trust policy,policy,access key,password

AWS Identity and Access Management
User Guide

The AWS Documentation website is getting a new look!
Try it now and let us know what you think. Switch to the new look >>
You can return to the original look by selecting English in the language selector above.

# Actions, Resources, and Condition Keys for Amazon DynamoDB

Amazon DynamoDB (service prefix: `dynamodb`) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

- Learn how to configure this service.

- View a list of the API operations available for this service.

- Learn how to secure this service and its resources by using IAM permission policies.

Topics

- Actions Defined by Amazon DynamoDB
- Resources Defined by Amazon DynamoDB
- Condition Keys for Amazon DynamoDB

## Actions Defined by Amazon DynamoDB

You can specify the following actions in the `Action` element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the `Resource` element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The Actions Table.

Actions | Description | Access Level | Resource Types (*required) | Condition Keys | Dependent Actions
--- | --- | --- | --- | --- | ---
BatchGetItem | Returns the attributes of one or more items from one or more tables | Read | table* |  |
| dynamodb:Attributes dynamodb:LeadingKeys dynamodb:ReturnConsumedCapacity dynamodb:Select |
BatchWriteItem | Puts or deletes multiple items in one or more tables | Write | table* |  |
| dynamodb:Attributes dynamodb:LeadingKeys dynamodb:ReturnConsumedCapacity |
ConditionCheckItem | The ConditionCheckItem operation checks the existence of a set of attributes for the item with the given primary key | Read | table* |  |
| dynamodb:Attributes dynamodb:LeadingKeys dynamodb:ReturnConsumedCapacity dynamodb:ReturnValues |
CreateBackup | Creates a backup for an existing table | Write | table* |  |
CreateGlobalTable | Enables the user to create a global table from an existing table | Write | global-table* |  |
table* |  |
CreateTable | The CreateTable operation adds a new table to your account | Write | table* |  |
DeleteBackup | Deletes an existing backup of a table | Write | backup* |  |
DeleteItem | Deletes a single item in a table by primary key | Write | table* |  |
| dynamodb:Attributes dynamodb:EnclosingOperation dynamodb:LeadingKeys dynamodb:ReturnConsumedCapacity dynamodb:ReturnValues |
DeleteTable | The DeleteTable operation deletes a table and all of its items | Write | table* |  |
DescribeBackup | Describes an existing backup of a table | Read | backup* |  |
DescribeContinuousBackups | Checks the status of the backup restore settings on the specified table | Read | table* |  |
DescribeGlobalTable | Returns information about the specified global table | Read | global-table* |  |
DescribeGlobalTableSettings | Returns settings information about the specified global table | Read | global-table* |  |
DescribeLimits | Returns the current provisioned-capacity limits for your AWS account in a region, both for the region as a whole and for any one DynamoDB table that you create there | Read |  |  |
DescribeReservedCapacity | Describes one or more of the Reserved Capacity purchased | Read |  |  |
DescribeReservedCapacityOfferings | Describes Reserved Capacity offerings that are available for purchase | Read |  |  |
DescribeStream | Returns information about a stream, including the current status of the stream, its Amazon Resource Name (ARN), the composition of its shards, and its corresponding DynamoDB table | Read | stream* |  |
DescribeTable | Returns information about the table | Read | table* |  |
DescribeTimeToLive | Gives a description of the Time to Live (TTL) status on the specified table. | Read | table* |  |
GetItem | The GetItem operation returns a set of attributes for the item with the given primary key | Read | table* |  |
| dynamodb:Attributes dynamodb:EnclosingOperation dynamodb:LeadingKeys dynamodb:ReturnConsumedCapacity dynamodb:Select |
GetRecords | Retrieves the stream records from a given shard | Read | stream* |  |
GetShardIterator | Returns a shard iterator | Read | stream* |  |
ListBackups | List backups associated with the account and endpoint | List |  |  |
ListGlobalTables | Lists all global tables that have a replica in the specified region | List |  |  |
ListStreams | Returns an array of stream ARNs associated with the current account and endpoint | Read |  |  |
ListTables | Returns an array of table names associated with the current account and endpoint | List |  |  |
ListTagsOfResource | List all tags on an Amazon DynamoDB resource | Read | table* |  |
PurchaseReservedCapacityOfferings | Purchases Reserved Capacity for use with your account | Write |  |  |
PutItem | Creates a new item, or replaces an old item with a new item | Write | table* |  |
| dynamodb:Attributes dynamodb:EnclosingOperation dynamodb:LeadingKeys dynamodb:ReturnConsumedCapacity dynamodb:ReturnValues |
Query | Uses the primary key of a table or a secondary index to directly access items from that table or index | Read | table* |  |
index |  |
| dynamodb:Attributes dynamodb:LeadingKeys dynamodb:ReturnConsumedCapacity dynamodb:ReturnValues dynamodb:Select |
RestoreTableFromBackup | Creates a new table from an existing backup | Write | backup* |  |
table* |  |
RestoreTableToPointInTime | Restores a table to a point in time | Write | table* |  |
Scan | Returns one or more items and item attributes by accessing every item in a table or a secondary index | Read | table* |  |
index |  |
| dynamodb:Attributes dynamodb:LeadingKeys dynamodb:ReturnConsumedCapacity dynamodb:ReturnValues dynamodb:Select |
TagResource | Associate a set of tags with an Amazon DynamoDB resource | Tagging | table* |  |
UntagResource | Removes the association of tags from an Amazon DynamoDB resource. | Tagging | table* |  |
UpdateContinuousBackups | Enables or disables continuous backups | Write | table* |  |
UpdateGlobalTable | Enables the user to add or remove replicas in the specified global table | Write | global-table* |  |
table* |  |
UpdateGlobalTableSettings | Enables the user to update settings of the specified global table | Write | global-table* |  |
table* |  |
UpdateItem | Edits an existing item's attributes, or adds a new item to the table if it does not already exist | Write | table* |  |
| dynamodb:Attributes dynamodb:EnclosingOperation dynamodb:LeadingKeys dynamodb:ReturnConsumedCapacity dynamodb:ReturnValues |
UpdateTable | Modifies the provisioned throughput settings, global secondary indexes, or DynamoDB Streams settings for a given table | Write | table* |  |
UpdateTimeToLive | Enables or disables TTL for the specified table | Write | table* |  |

## Resources Defined by Amazon DynamoDB

The following resource types are defined by this service and can be used in the `Resource` element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The Resource Types Table.

Resource Types | ARN | Condition Keys
--- | --- | ---
index | `arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}/index/${IndexName}` |
stream | `arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}/stream/${StreamLabel}` |
table | `arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}` |
backup | `arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}/backup/${BackupName}` |
global-table | `arn:${Partition}:dynamodb::${Account}:global-table/${GlobalTableName}` |

## Condition Keys for Amazon DynamoDB

Amazon DynamoDB defines the following condition keys that can be used in the `Condition` element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The Condition Keys Table.

To view the global condition keys that are available to all services, see Available Global Condition Keys in the IAM Policy Reference.

Note

For information about how to use context keys to refine DynamoDB access using an IAM policy, see Using IAM Policy Conditions for Fine-Grained Access Control in the Amazon DynamoDB Developer Guide.

Condition Keys | Description | Type
--- | --- | ---
dynamodb:Attributes | Filter based on the attribute (field or column) names of the table. | String
dynamodb:EnclosingOperation | Used to block Transactions APIs calls and allow the non-Transaction APIs calls and vice-versa. | String
dynamodb:LeadingKeys | Filters based on the partition key of the table. | String
dynamodb:ReturnConsumedCapacity | Filter based on the ReturnConsumedCapacity parameter of a request. Contains either "TOTAL" or "NONE". | String
dynamodb:ReturnValues | Filter based on the ReturnValues parameter of request. Contains one of the following: "ALL_OLD", "UPDATED_OLD","ALL_NEW","UPDATED_NEW", or "NONE". | String
dynamodb:Select | Filter based on the Select parameter of a Query or Scan request. | String

On this page:

- Actions Defined by Amazon DynamoDB
- Resources Defined by Amazon DynamoDB
- Condition Keys for Amazon DynamoDB

We use cookies to provide and improve our services. By using our site, you consent to cookies. Learn more