An IAM policy is attached to a user to allow read access to the Orders table in DynamoDB. The user reports that a GetItem call for an order returns an 'AccessDeniedException'. What is the likely cause?
The condition requires that only these attributes be returned, so the request must explicitly project them.
Why this answer
When an IAM policy uses the `dynamodb:Attributes` condition key to restrict access to specific attributes (e.g., `order_id` and `status`), the user must include a `ProjectionExpression` in the `GetItem` request that explicitly lists only those allowed attributes. Without the projection expression, DynamoDB attempts to return all attributes, which triggers an `AccessDeniedException` because the policy denies access to attributes not listed in the condition.
Exam trap
AWS often tests the misconception that a table-level permission error is the cause, when in reality the issue is a missing `ProjectionExpression` due to attribute-level restrictions in the IAM policy.
How to eliminate wrong answers
Option B is wrong because the user does have permissions to perform GetItem on the Orders table; the error is caused by attribute-level restrictions, not a lack of table-level permission. Option C is wrong because the resource ARN in the policy is correct; including a wildcard for the table would not resolve the attribute-level restriction issue. Option D is wrong because the condition key `dynamodb:Attributes` does restrict access to only two attributes, and the user cannot get all attributes; the GetItem call must use a projection expression to limit the returned attributes to those allowed.