Prevent human access to DynamoDB data?

Question

I am trying to prevent human access to DynamoDB table. I'm currently thinking of two approaches

1. Deny based on `aws:PrincipalType` - account and user
2. Allow KMS access only to AWS services

Is there a better approach to solve this problem?

Answer

Hi,

I'd recommend to use a least-priviledge approach. Instead of denying access for certain principals (humans in this case), you should only grant permissions to those principals you know for sure need access (not humans). AWS denies access by default, so if you don't explictly allow an acces, AWS will block it. If you only grant access to the principals you want, AWS will block the rest, including humans.

* [How Amazon DynamoDB works with IAM](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/security_iam_service-with-iam.html)
* [Determining whether a request is allowed or denied within an account](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow)

I hope this helps.

Prevent human access to DynamoDB data?

Relevant content