A Lambda that only writes to one DynamoDB table was given Administr…

Question

A Lambda that only writes to one DynamoDB table was given AdministratorAccess to unblock a sprint. What should replace that policy?

Accepted Answer

Attach a least-privilege execution role that allows only the required DynamoDB write actions on that table resource. — Admin on a single-table writer is a skeleton key for a locker that only needs one padlock. Swap it for a role that can Put/Update that table—and nothing else. Root keys in env vars make it worse.

Answer

Keep AdministratorAccess and add a second FullAccess managed policy for redundancy.

Answer

Embed root account credentials in environment variables marked secure.

Answer

Grant s3: on all buckets because DynamoDB eventually stores data in S3-compatible APIs.

A Lambda that only writes to one DynamoDB table was given AdministratorAccess to unblock a sprint. What should replace that policy?

Short Explanation

Full Explanation