nerdexam
Amazon

DBS-C01 · Question #142

A company uses the Amazon DynamoDB table contractDB in us-east-1 for its contract system with the following schema: orderID (primary key) timestamp (sort key) contract (map) createdBy (string)…

The correct answer is A. { "Version": "2012-10-17", "Statement": [ { "Sid": "IAMPolicy", "Effect": "Allow", "Action": [ "dynamodb:Query" ], "Resource": [ "arn:aws:dynamodb:us-east-1:123456789012:table/contractDB" ], "Condition": { "ForAllValues:StringLike": { "dynamodb:Attributes": [ "orderID", "timestamp", "contract", "createdBy" ] }, "StringEquals": { "dynamodb:Select": "SPECIFIC_ATTRIBUTES" } } } ] }. Option A is correct because it uses a deny-by-exclusion approach - it explicitly allows access only to the specific attributes (orderID, timestamp, contract, createdBy) while omitting customerEmail, combined with 'dynamodb:Select': 'SPECIFIC_ATTRIBUTES' which enforces that the…

Submitted by kev92· Mar 6, 2026Security and Compliance - Implementing fine-grained access control on DynamoDB using IAM condition keys (dynamodb:Attributes and dynamodb:Select) to restrict access to specific table attributes for least-privilege and regulatory compliance purposes.

Question

A company uses the Amazon DynamoDB table contractDB in us-east-1 for its contract system with the following schema:

orderID (primary key) timestamp (sort key) contract (map) createdBy (string) customerEmail (string) After a problem in production, the operations team has asked a database specialist to provide an IAM policy to read items from the database to debug the application. In addition, the developer is not allowed to access the value of the customerEmail field to stay compliant. Which IAM policy should the database specialist use to achieve these requirements? A. B. C. D.

Options

  • A{ "Version": "2012-10-17", "Statement": [ { "Sid": "IAMPolicy", "Effect": "Allow", "Action": [ "dynamodb:Query" ], "Resource": [ "arn:aws:dynamodb:us-east-1:123456789012:table/contractDB" ], "Condition": { "ForAllValues:StringLike": { "dynamodb:Attributes": [ "orderID", "timestamp", "contract", "createdBy" ] }, "StringEquals": { "dynamodb:Select": "SPECIFIC_ATTRIBUTES" } } } ] }
  • B{ "Version": "2012-10-17", "Statement": [ { "Sid": "IAMPolicy", "Effect": "Allow", "Action": [ "dynamodb:Query" ], "Resource": [ "arn:aws:dynamodb:us-east-1:123456789012:table/contractDB" ], "Condition": { "ForAllValues:StringLike": { "dynamodb:Attributes": [ "customerEmail" ] }, "StringEquals": { "dynamodb:Select": "SPECIFIC_ATTRIBUTES" } } } ] }

How the community answered

(39 responses)
  • A
    51% (20)
  • B
    49% (19)

Explanation

Option A is correct because it uses a deny-by-exclusion approach - it explicitly allows access only to the specific attributes (orderID, timestamp, contract, createdBy) while omitting customerEmail, combined with 'dynamodb:Select': 'SPECIFIC_ATTRIBUTES' which enforces that the query must explicitly name the attributes being retrieved. The ForAllValues:StringLike condition ensures that only the listed attributes can be requested, effectively blocking access to customerEmail without needing an explicit Deny statement.

Topics

#IAM Fine-Grained Access Control#DynamoDB Attribute-Level Security#IAM Condition Keys#Data Compliance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DBS-C01 Practice