DynamoDB IAM to scan an index, but not the table

Question

Question: Is there a restriction on scanning a DynamoDB index if the caller does not have permission to scan the underlying table? I can query the index without giving permission to the table, why can't I also scan it? If I should be able to scan, what else can I do to check why IAM is not allowing the request?

I have a role that grants access to scan and query an index. I have consulted the documentation for IAM [here](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondynamodb.html#amazondynamodb-table) and see no difference in requirements for Query and Scan operations.

I have created a role with the following minimal IAM policy
```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "dynamodb:Query",
                "dynamodb:Scan"
            ],
            "Resource": [
                "arn:aws:dynamodb:us-east-1:123456789012:table/prod-table/index/gsi1",
            ],
            "Effect": "Allow"
        }
}
```

I can use the CLI to query this index and get back items.

```bash
aws dynamodb query --table-name prod-table --index-name gsi1 --limit 10 --key-condition-expression "gsi1pk = :val" --expression-attribute-values '{":val": {"S": "entity"}}'
```

however, attempting a scan fails.

```bash
aws dynamodb scan --table-name prod-table --index-name gsi1 --limit 10
```

stating "An error occurred (AccessDeniedException) when calling the Scan operation: User: xxxx is not authorized to perform: dynamodb:Scan on resource: arn:aws:dynamodb:us-east-1: 123456789012:table/prod-table because no identity-based policy allows the dynamodb:Scan action"

EDIT: In addition, I am confused as to why I can update the policy to only grant access to the table (not the index), and this will allow me to scan an index, when I have not granted permission to scan an index. You may say "if you have access to the table items, then you implicitly have access to the index", but then why does the documentation state that I can supply an index arn as a resource for the scan action. In addition, I may want to protect my index against a scan because I have limited spare RCU on the index, but I have plenty of spare RCU on the main table.

Answer

This is because your policy only allows to Query and Scan the index (if you see your Resource policy, it says "arn:aws:dynamodb:us-east-1:123456789012:table/prod-table/index/gsi1").

You should, however, allow permissions to the table ("arn:aws:dynamodb:us-east-1: 123456789012:table/prod-table") as the error itself indicates.

The policy would remain like this:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "dynamodb:Query",
                "dynamodb:Scan"
            ],
            "Resource": [
                "arn:aws:dynamodb:us-east-1:123456789012:table/prod-table"
            ],
            "Effect": "Allow"
        }
}
```

DynamoDB IAM to scan an index, but not the table

Relevant content