Before shipping, a developer checks whether an IAM policy that allo…

Question

Before shipping, a developer checks whether an IAM policy that allows dynamodb:Query only on a table ARN also covers Query calls that target a global secondary index. What should they understand?

Accepted Answer

Query against an index generally requires the index ARN (or appropriate resource coverage) in the policy, not only the base table ARN. — Querying a GSI is a different door than querying the base table—IAM often wants the index ARN on the resource list. A table-only ARN can leave index Query denied. GSIs are not an S3 API.

Answer

Any table ARN automatically authorizes every index operation with no further resource entries.

Answer

DynamoDB indexes never appear in IAM Resource elements, so only Action matters.

Answer

GSIs are queried with s3:GetObject, so S3 permissions are required instead.

Before shipping, a developer checks whether an IAM policy that allows dynamodb:Query only on a table ARN also covers Query calls that target a global secondary index. What should they understand?

Short Explanation

Full Explanation