DevOps

DynamoDB IAM Policy Generator

Generate secure IAM JSON policies for Amazon DynamoDB table access — CRUD operations, query-only, scan, and Global Secondary Index permissions.

Quick Policy Templates
#1
arn:aws:dynamodb:us-east-1:123456789012:table/MyTable

Least Privilege Verified

Policy statements are explicitly scoped to designated AWS actions and Resource ARNs.

Generated IAM Policy JSON
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowDynamodbAccess",
      "Effect": "Allow",
      "Action": "dynamodb:GetItem",
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"
    }
  ]
}

DynamoDB IAM Policy Generator: Complete Guide

DynamoDB Least-Privilege CRUD Policy

DynamoDB IAM policies should always be scoped to specific tables. Avoid granting 'dynamodb:*' or using wildcard Resource ARNs. For read-heavy workloads, consider separating read and write permissions into distinct policy statements.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowDynamoDBCrud",
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:Query"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"
    }
  ]
}

IAM Policy Generators for Other AWS Services

S3 Bucket IAM Policy GeneratorLambda IAM Policy GeneratorEC2 IAM Policy GeneratorAll Services →

How to Use

  1. 1

    Service Pre-Selected

    This page has pre-configured the generator for DynamoDB. Adjust actions and Resource ARNs as needed.

  2. 2

    Select Allowed Actions

    Click the action tags to toggle specific API permissions on or off. Add custom actions if needed.

  3. 3

    Specify Resource ARNs

    Enter exact Amazon Resource Names to enforce the Principle of Least Privilege.

  4. 4

    Verify & Copy

    Check the real-time security audit badge for wildcard warnings, then copy the formatted JSON policy.

Frequently Asked Questions

What IAM actions do I need for DynamoDB CRUD operations?+

For full CRUD access to a DynamoDB table, include: 'dynamodb:GetItem', 'dynamodb:PutItem', 'dynamodb:UpdateItem', 'dynamodb:DeleteItem', and 'dynamodb:Query'. Add 'dynamodb:Scan' only if your application requires full table scans.

How do I restrict IAM access to a specific DynamoDB table?+

Set the Resource ARN to your specific table: 'arn:aws:dynamodb:REGION:ACCOUNT_ID:table/TABLE_NAME'. Never use '*' as the Resource for DynamoDB — this grants access to every table in your account.