Does the IAM policy need include access to the CMK chosen for DynamoDB encryption in order to access the DynamoDB?

Question

When I create a DynamoDB table, I can choose to encrypt the table use a customer managed Key (CMK). My question is when creating an IAM role/policy to allow say, read/write to the table, like dynamodb:GetItem, do I also need to add permission to access the key itself? I did not seem see this in the AWS DynamoDB doc.

Leeroy Hannigan · Accepted Answer · 2024-12-27 18:00:44Z

Yes you do, you can either add the permissions to the role, or to the key policy.

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/encryption.usagenotes.html#dynamodb-kms-authz

Collectives™ on Stack Overflow

Does the IAM policy need include access to the CMK chosen for DynamoDB encryption in order to access the DynamoDB?

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related