CODEWITHSUNDEEP
amazon-web-servicesamazon-dynamodbamazon-cognito
zefre
zefre

Reputation: 23

AWS: Is it possible to share DynamoDB items across multiple users?

By looking at the documentation on DynamoDB, I was able to find some examples of restricting item access for users based on the table's primary key. However, all of these examples only cover restricting access to a single user. Is there a way to allow access only for a group of users? From what I've read, this would come down to creating IAM groups/roles, but there is a limit on how many of each can be created, and it doesn't seem like doing so programmatically for each item would work well.

Upvotes: 2

Views: 847

Answers (1)

Logan Pickup
Logan Pickup

Reputation: 2374

Your guess is correct; you would need an IAM policy per shared row.

There are no substitution variables currently available as far as I know to get the group(s) a user is part of, so no single IAM policy will be able to cover your use case.

Not only that, only the partition key can be matched with conditions in the IAM policy, so unless your partition key has a group name as part of it (which implies that users can never change groups) you will require, as you imply, an IAM policy per row in the database, which won't scale.

It could be acceptable if you have controls in place to limit the number of shared items, and are aggressive about cleaning up the policies for items that are no longer shared.

I don't think using AWS's built-in access controls to allow group access is going to work very well, though, and you'll be better off building a higher-level abstraction on top that does have the access control you need (using AWS Lambda, for example).

Upvotes: 3

Related Questions