Amazon DynamoDB across account access with VPC endpoints

Question

Endpoints for Amazon DynamoDB is documented here
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-ddb.html

I don't see any mention of setting up cross account access for Endpoints for Amazon DynamoDB, is it supported? How can our customer achieve it?

Accepted Answer

What you are trying to do is access a DynamoDB table in a different account. 
DynamoDB does not support [Resource Based Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html) (c.f. S3, KMS, SQS to name a few)   the way you access DynamoDB is always with a  principal of the account that provisioned the DynamoDB Table resource. So, by assuming a role in the account with the table you can access it.

Here is the process for cross-account role assume:

***1: Create a role with access to the DynamoDB table in the DynamoDB account. I'll throw a rough example of what the IAM setup would look like below, note the variables you need to fill in in the <> blocks:***

**DynamoDB Role Trust Policy:**

`{
"Version": "2012-10-17",
"Statement": {
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
      "Principal": {
        "AWS": "arn:aws:iam:::root"
      }
  }
}
`

**DynamoDB Role IAM Policy:**

`{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:List*",
                "dynamodb:DescribeReservedCapacity*",
                "dynamodb:DescribeLimits",
                "dynamodb:DescribeTimeToLive"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:BatchGet*",
                "dynamodb:DescribeStream",
                "dynamodb:DescribeTable",
                "dynamodb:Get*",
                "dynamodb:Query",
                "dynamodb:Scan",
                "dynamodb:BatchWrite*",
                "dynamodb:CreateTable",
                "dynamodb:Delete*",
                "dynamodb:Update*",
                "dynamodb:PutItem"
            ],
            "Resource": "arn:aws:dynamodb:*:*:table/"
        }
    ]
}`

***2: Create a role in the other account that is allowed to assume the DynamoDB role:***

**IAM Policy for App Role**

`
{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": "arn:aws:iam:::role/"
  }
}`

***3: Assume the role in your app. Here is an example in Python:***

**AssumeRole.py**
`
import boto3

def assumerole(account, rolename):
    sts_client = boto3.client('sts')

# Call the assume_role method of the STSConnection object and pass the role
    # ARN and a role session name.
    assumedRoleObject = sts_client.assume_role(
        RoleArn="arn:aws:iam::" + account + ":role/" + rolename,
        RoleSessionName=account + "-" + rolename.replace('/','')
    )
    return assumedRoleObject
`

***4: Run your DynamoDB commands with the assumed role's credentials***

As for the networking side, just make sure your VPC in the application account has a DynamoDB endpoint and you should be good to go.

Amazon DynamoDB across account access with VPC endpoints

Relevant content