DynamoDB - Fine grain control scoped to Cognito User

I have a table that will contain rows of data for all users of the app. But I only want User A to access rows added by User A, User B to access User B's rows, etc. So its essentially a user-scoped database.

IAM Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "dynamodb:PutItem",
                "dynamodb:GetItem",
                "dynamodb:DeleteItem",
                "dynamodb:Query",
                "dynamodb:Scan"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:0000000:table/my-table",
            "Condition": {
                "ForAllValues:StringEquals": {
                    "dynamodb:LeadingKeys": [
                        "${cognito-identity.amazonaws.com:sub}"
                    ]
                }
            }
        }
    ]
}

I believe the "cognito-identity.amazonaws.com:sub" for my user is: us-east-1:XXXXX

My id for rows is us-east-1:XXXXX#uuid1 but us-east-1:XXXXX cant access it. I get: AccessDeniedException

However, the following condition worked:

"Condition": {
  "ForAllValues:StringEquals": {
    "cognito-identity.amazonaws.com:sub": [
      "us-east-1:XXXXX"
    ]
  }
}