An inspection-api ECS task role must read case rows from one DynamoDB table. Which permissions statement best matches least privilege?
Select an answer to reveal the explanation.
Short Explanation
Give the inspection desk a key to one filing cabinet, not a master key to City Hall. Scope GetItem to that table ARN. Star-on-star policies feel convenient until someone dumps the wrong table.
Full Explanation
Least-privilege IAM for application roles limits actions and resources to what the service needs. For a single-table GetItem path, the policy should allow the required DynamoDB read actions on that table’s ARN rather than dynamodb: on Resource "". Broad wildcards enlarge blast radius. Denying everything except Scan does not express the intended GetItem access pattern and encourages inefficient full-table reads.