AmazonDynamoDBFullAccess_v2
Last Modified
Mar 12, 2026
March 12, 2026 at 09:27 PM UTC
Version
v3
Total Versions
1
Created
Feb 12, 2026
Actions
27
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can rewrite resource policies and sharing
Grants 2 permissions management actions across 1 service (dynamodb) on any resource, enough to share resources outside the account.
dynamodb:deleteresourcepolicydynamodb:putresourcepolicyUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
- Medium
Can read data in every bucket or table
Reads any DynamoDB table. Read-only is not the same as harmless when the data is the asset.
dynamodb:Scan (via dynamodb:*)dynamodb:GetItem (via dynamodb:*)Use with caution: Read access to data is still access to data. For people who only need to see configuration, ViewOnlyAccess carries none of these signals.
- Medium
Full access to 2 services on every resource
Uses dax:*, dynamodb:* with Resource "*" and no condition, so every action AWS adds to those services later is granted too.
dax:*dynamodb:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DDBAndDAXFullAccess",
"Effect": "Allow",
"Action": [
"dynamodb:*",
"dax:*"
],
"Resource": "*"
},
{
"Sid": "KMSIntegration",
"Effect": "Allow",
"Action": [
"kms:DescribeKey",
"kms:ListAliases"
],
"Resource": "*"
},
{
"Sid": "LambdaIntegration",
"Effect": "Allow",
"Action": [
"lambda:ListEventSourceMappings",
"lambda:ListFunctions"
],
"Resource": "*"
},
{
"Sid": "DaxSNSIntegration",
"Effect": "Allow",
"Action": [
"sns:ListTopics"
],
"Resource": "*"
},
{
"Sid": "ApplicationAutoscalingIntegration",
"Effect": "Allow",
"Action": [
"application-autoscaling:DeleteScalingPolicy",
"application-autoscaling:DeregisterScalableTarget",
"application-autoscaling:PutScalingPolicy",
"application-autoscaling:RegisterScalableTarget"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"application-autoscaling:service-namespace": "dynamodb"
}
}
},
{
"Sid": "ApplicationAutoscalingDescribeActions",
"Effect": "Allow",
"Action": [
"application-autoscaling:DescribeScalableTargets",
"application-autoscaling:DescribeScalingActivities",
"application-autoscaling:DescribeScalingPolicies"
],
"Resource": "*"
},
{
"Sid": "TagManagement",
"Effect": "Allow",
"Action": [
"tag:GetResources"
],
"Resource": "*"
},
{
"Sid": "CloudwatchMonitoring",
"Effect": "Allow",
"Action": [
"cloudwatch:DescribeAlarms",
"cloudwatch:GetMetricStatistics",
"cloudwatch:GetMetricData"
],
"Resource": "*"
},
{
"Sid": "ListKinesisResources",
"Effect": "Allow",
"Action": [
"kinesis:ListStreams",
"kinesis:DescribeStream",
"kinesis:DescribeStreamSummary"
],
"Resource": "*"
},
{
"Sid": "ListEC2ResourcesForDaxClusterCreation",
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups"
],
"Resource": "*"
},
{
"Sid": "CloudwatchInsightsRules",
"Effect": "Allow",
"Action": "cloudwatch:GetInsightRuleReport",
"Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*"
},
{
"Sid": "ServiceRoleCreation",
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": [
"replication.dynamodb.amazonaws.com",
"dax.amazonaws.com",
"dynamodb.application-autoscaling.amazonaws.com",
"contributorinsights.dynamodb.amazonaws.com",
"kinesisreplication.dynamodb.amazonaws.com"
]
}
}
},
{
"Sid": "IamIntegration",
"Effect": "Allow",
"Action": [
"iam:ListRoles"
],
"Resource": [
"*"
]
}
]
},
"VersionId": "v3",
"IsDefaultVersion": true,
"CreateDate": "2026-02-12T18:02:57+00:00"
}
}Version History (4 recorded)
Raw historyAmazonDynamoDBFullAccess_v2 - Policy Version v3
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
51b5967AmazonDynamoDBFullAccess_v2 - Policy Version v3
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
7afd21eAmazonDynamoDBFullAccess_v2 - Policy Version v2
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
1959f78Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 22, 2025
3328a89