DEA-C01 Data Store Management Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:Query"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders",
      "Condition": {
        "ForAllValues:StringEquals": {
          "dynamodb:LeadingKeys": [
            "${cognito-identity.amazonaws.com:sub}"
          ]
        }
      }
    }
  ]
}

An IAM policy is attached to a role assumed by authenticated users via Amazon Cognito. What does this policy allow?

⚠ Common exam trap

A common mix-up: candidates assume the policy grants full read access (Option B) or includes write permissions (Option A), overlooking the critical condition that restricts access to only items matching the user's Cognito identity ID.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Users can read items in the Orders table only if the partition key matches their Cognito identity ID.

The policy uses a condition key like `dynamodb:LeadingKeys` with a value referencing `${cognito-identity.amazonaws.com:sub}`. This restricts DynamoDB actions to items where the partition key matches the user's Cognito identity ID, ensuring fine-grained access control. Option D correctly states that users can read items only when the partition key equals their identity ID, which is the intended behavior for row-level security.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Users can read and write items in the Orders table where the partition key matches their Cognito identity ID.
Why it's wrong here
The policy only allows read actions, not write.
✗
Users can read any item in the Orders table using GetItem and Query.
Why it's wrong here
The condition restricts to items with a specific partition key.
✗
Users can scan the entire Orders table but only if they use a filter expression.
Why it's wrong here
Scan is not allowed, and the condition only applies to GetItem and Query.
✓
Users can read items in the Orders table only if the partition key matches their Cognito identity ID.
Why this is correct
The LeadingKeys condition restricts based on the partition key equal to the Cognito sub.

Go deeper

DEA-C01 Data Store Management Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question