DBS-C01 Workload-Specific Database Design Practice Question

Exhibit

Refer to the exhibit.

Consider the following IAM policy attached to an IAM role used by an application:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:GetItem",
                "dynamodb:Query",
                "dynamodb:PutItem"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/orders",
            "Condition": {
                "ForAllValues:StringEquals": {
                    "dynamodb:LeadingKeys": ["${aws:userid}"]
                }
            }
        }
    ]
}

The application uses the IAM role to access the 'orders' DynamoDB table. What is the intended effect of this policy?

⚠ Common exam trap

Candidates often assume a policy with `Allow` on DynamoDB actions grants full table access, overlooking the `Condition` block that restricts access to specific items based on the partition key.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The role can only access items where the partition key matches the principal's identifier

The policy uses a condition key like `dynamodb:LeadingKeys` with a value referencing the principal's identifier (e.g., `${aws:userid}`). This restricts access to only those items in the 'orders' table whose partition key matches the IAM role's unique identifier, enforcing row-level security. The intended effect is fine-grained access control, not full table access or time-based restrictions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The role can perform any DynamoDB action on the 'orders' table
Why it's wrong here
Only GetItem, Query, PutItem are allowed, and with a condition.
✓
The role can only access items where the partition key matches the principal's identifier
Why this is correct
The condition restricts access to items with LeadingKeys equal to the aws:userid.
✗
The role can access all items in the table but only during specific times
Why it's wrong here
No time-based condition is specified.
✗
The role is denied access to the 'orders' table
Why it's wrong here
Effect is Allow, not Deny.

Go deeper

DBS-C01 Workload-Specific Database Design Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question