AWS First Steps
New feature

Amazon DynamoDB Streams now supports attribute-based access control

Amazon DynamoDB Streams supports attribute-based access control (ABAC) using tag-based conditions in IAM policies for fine-grained access management across teams and applications

Amazon DynamoDB Streams now supports attribute-based access control (ABAC), allowing the use of tag-based conditions in IAM policies. This approach simplifies access management by enabling different access levels for multiple teams and applications with fewer IAM policies. Users can attach up to 50 tags per stream and use these in IAM policy conditions to allow or deny specific actions-for example, permitting read access only to streams tagged with "environment:production". Stream tags are managed separately from parent table tags, providing flexibility for environment segregation and compliance without creating numerous individual IAM policies. ABAC is available in all commercial AWS Regions and AWS GovCloud (US) Regions where DynamoDB Streams is offered, at no additional cost.

Why it matters

DynamoDB Streams captures table activity in streams. This update enhances access control capabilities for more granular management.

Read the original AWS announcement

Related articles and terms

AWS IAM Fine-Grained Access Control - How Policy-Based Design Achieves the Principle of Least PrivilegeExplore the design philosophy behind AWS IAM's policy-based access control and compare its granularity with Azure RBAC and GCP IAM in concrete terms.Tag Design Determines Operations - Trivia and Practical Naming Conventions for AWS Resource Tagging StrategyWe explain why AWS resource tags are not just labels but the foundation for cost allocation, access control, and automation, covering tag key naming conventions, how to use the 50-tag limit, and governance through tag policies.Designing Identity and Access Management - Achieving Zero Trust Security with IAMLearn access management design techniques with AWS IAM, including the principle of least privilege, policy design, and achieving zero trust security through Cognito integration.Serverless Databases - Scalable Data Management with DynamoDBBuild databases that automatically scale with traffic using Aurora Serverless v2 and DynamoDB on-demand mode. Learn the selection criteria for serverless databases based on workload characteristics.AWS IAMAn authentication and authorization service for securely controlling access to AWS resources, providing fine-grained access management through users, groups, roles, and policies