Prevent human access to DynamoDB data?


I am trying to prevent human access to DynamoDB table. I'm currently thinking of two approaches

  1. Deny based on aws:PrincipalType - account and user
  2. Allow KMS access only to AWS services

Is there a better approach to solve this problem?

1 Answer


I'd recommend to use a least-priviledge approach. Instead of denying access for certain principals (humans in this case), you should only grant permissions to those principals you know for sure need access (not humans). AWS denies access by default, so if you don't explictly allow an acces, AWS will block it. If you only grant access to the principals you want, AWS will block the rest, including humans.

I hope this helps.

answered 2 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions