DBS-C01 Workload-Specific Database Design Practice Question

Exhibit

Refer to the exhibit.

=== IAM Policy for DynamoDB Access ===
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowReadAccess",
            "Effect": "Allow",
            "Action": "dynamodb:GetItem",
            "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders",
            "Condition": {
                "ForAllValues:StringEquals": {
                    "dynamodb:Attributes": ["order_id", "status"]
                }
            }
        },
        {
            "Sid": "DenyWriteAccess",
            "Effect": "Deny",
            "Action": "dynamodb:*",
            "Resource": "*"
        }
    ]
}

An IAM policy is attached to a user to allow read access to the Orders table in DynamoDB. The user reports that a GetItem call for an order returns an 'AccessDeniedException'. What is the likely cause?

⚠ Common exam trap

AWS often tests the misconception that a table-level permission error is the cause, when in reality the issue is a missing `ProjectionExpression` due to attribute-level restrictions in the IAM policy.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The user must specify a projection expression in the GetItem request to include only 'order_id' and 'status' attributes.

When an IAM policy uses the `dynamodb:Attributes` condition key to restrict access to specific attributes (e.g., `order_id` and `status`), the user must include a `ProjectionExpression` in the `GetItem` request that explicitly lists only those allowed attributes. Without the projection expression, DynamoDB attempts to return all attributes, which triggers an `AccessDeniedException` because the policy denies access to attributes not listed in the condition.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The user must specify a projection expression in the GetItem request to include only 'order_id' and 'status' attributes.
Why this is correct
The condition requires that only these attributes be returned, so the request must explicitly project them.
✗
The user does not have permissions to perform GetItem on the Orders table.
Why it's wrong here
The policy explicitly allows GetItem.
✗
The resource ARN is incorrect; it should include the wildcard for the table.
Why it's wrong here
The ARN is correct for a specific table.
✗
The condition key 'dynamodb:Attributes' restricts access to only two attributes, but the user can still get all attributes.
Why it's wrong here
The condition restricts which attributes can be returned; without specifying a projection, all attributes are requested and denied.

Go deeper

DBS-C01 Workload-Specific Database Design Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question