DBS-C01 IAM policy for DynamoDB GSI Practice Question
A company uses Amazon DynamoDB with a global secondary index (GSI). The security team requires that only specific IAM users can query the GSI. Which THREE conditions must be met to restrict access to the GSI?
⚠ Common exam trap
A common mistake is to think the dynamodb:IndexName condition key restricts access to a GSI, but in IAM, you must specify the index ARN in the Resource element of the policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user must have permission to query the base table as well.
The correct answers are C, D, and E. To restrict access to a GSI, you must ensure the user has permission to query the base table (C), allow the dynamodb:Query action on the index (D), and specify the index ARN in the Resource element (E). Option A is incorrect because the dynamodb:IndexName condition key is not used for IAM authorization; access to a GSI is controlled via the resource ARN, not a condition key. Option B is incorrect because the dynamodb:Attributes condition key restricts which attributes are returned, not access to the GSI itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The policy must include a condition 'dynamodb:IndexName' with the index name.
Why it's wrong here
The index name is specified in the resource ARN, not as a condition.
- ✗
The policy must include a condition key 'dynamodb:Attributes' to restrict which attributes are returned.
Why it's wrong here
This condition restricts projected attributes, not access to the index.
- ✓
The user must have permission to query the base table as well.
Why this is correct
Querying a GSI requires access to the base table.
- ✓
The policy must allow the 'dynamodb:Query' action on the index.
Why this is correct
Query action is needed to query the GSI.
- ✓
The IAM policy must specify the index ARN in the Resource element.
Why this is correct
The resource must include the index ARN.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.