An inspection-api ECS task role must read case rows from one DynamoDB table. Which permissions statement best matches least privilege?
Select an answer to reveal the explanation.
Short Explanation
Give the inspection desk a key to one filing cabinet, not a master key to City Hall. Scope GetItem to that table ARN. Star-on-star policies feel convenient until someone dumps the wrong table.
Full Explanation
Least privilege for an inspection-api ECS task reading case rows means allowing only the needed DynamoDB read actions on that table’s ARN—and on index ARNs if Queries use GSIs/LSIs—not wildcards across all tables and actions. Scope GetItem, Query, and BatchGetItem as required for the API’s access patterns so a compromised task cannot drop tables, rewrite cases, or read unrelated municipal datasets.
Allowing dynamodb: on Resource "" maximizes blast radius “so future tables work without redeploying IAM,” which is convenience over security. Combining s3: and dynamodb: on "*" because inspections also store photos over-scopes both services in one policy gesture; photo access should be a separate, narrower statement. Denying everything except Scan forces the least efficient read pattern and is not least privilege for point or key-based lookups.
Exam caveat: if the task Queries a GSI, include the index ARN in the Resource element; a base table ARN alone is often insufficient for index operations. Operational check: run the task with the tightened role, confirm case reads succeed, attempt PutItem, DeleteTable, or access to another table, and confirm those calls fail with AccessDenied in application logs and CloudTrail.