An IAM policy is attached to a user to restrict access to a DynamoDB table. What does this policy allow the user to do?
The condition restricts operations to items with LeadingKeys 'customer_123'.
Why this answer
The IAM policy uses a condition key `dynamodb:LeadingKeys` with a condition operator `ForAllValues:StringEquals` to restrict access to items where the partition key equals 'customer_123'. This allows the user to perform read and write operations only on items matching that specific partition key value, enforcing fine-grained access control at the item level.
Exam trap
The trap here is that candidates often assume a policy restricting access to a specific partition key still allows a full table Scan, but DynamoDB's fine-grained access control with `dynamodb:LeadingKeys` explicitly denies any operation that does not specify the allowed partition key, including Scans.
How to eliminate wrong answers
Option B is wrong because the policy explicitly restricts access to items with partition key 'customer_123', not any item in the table. Option C is wrong because a Scan operation would access all items in the table, which violates the partition key restriction; the policy does not allow scanning the entire table. Option D is wrong because the policy does not allow all DynamoDB actions; it only allows specific actions (like GetItem, PutItem, UpdateItem, DeleteItem, Query) conditioned on the partition key value, and actions like CreateTable or DeleteTable are not permitted.