DynamoDB Security: IAM Fine-Grained Access, KMS आणि VPC Endpoints

By Ravindra Bagale, trainer · LinkedIn · Last updated: 31 October 2026

1. रोजचे उदाहरण: hotel key cards

Master = IAM *. Guest card = LeadingKeys. Cylinder = KMS. Private lift = VPC endpoint.

2. Vertical steps

3. हे का लागतं?

हे का लागतं?

Stolen keys + broad roles = leak. FGAC tenant stop. KMS decrypt control. VPC private path.

4. हे काय आहे?

हे काय आहे?

IAM actions+ARNs. LeadingKeys condition. SSE-DynamoDB किंवा CMK. VPC gateway endpoint.

5. कसं करायचं

कसं करायचं (step by step)

1. Who × which table.
2. Table + index ARNs.
3. LeadingKeys.
4. KMS choice.
5. VPC endpoint.
6. Optional SCP.
7. Negative test.

6. IAM policy sketch (LeadingKeys)

{
  "Effect": "Allow",
  "Action": ["dynamodb:GetItem","dynamodb:Query","dynamodb:PutItem","dynamodb:UpdateItem"],
  "Resource": [
    "arn:aws:dynamodb:ap-south-1:111122223333:table/lab-ddr-secure",
    "arn:aws:dynamodb:ap-south-1:111122223333:table/lab-ddr-secure/index/*"
  ],
  "Condition": {
    "ForAllValues:StringLike": {"dynamodb:LeadingKeys": ["TENANT#acme"]}
  }
}
# Meaning: role may only touch items whose PK begins with TENANT#acme.

App prefix + IAM. UI filter ≠ security.

7. KMS आणि encryption at rest

• Default AWS-owned.
• CMK = control + audit.
• Indexes/backups too.
• TLS in transit.

8. VPC gateway endpoint

Gateway endpoint + route. Endpoint policy. No NAT for DDB traffic.

9. Commands: output आणि अर्थ

aws dynamodb create-table --table-name lab-ddr-secure   --attribute-definitions AttributeName=PK,AttributeType=S AttributeName=SK,AttributeType=S   --key-schema AttributeName=PK,KeyType=HASH AttributeName=SK,KeyType=RANGE   --billing-mode PAY_PER_REQUEST   --sse-specification Enabled=true,SSEType=KMS
# Output: TableStatus CREATING; SSEDescription present when active
aws dynamodb describe-table --table-name lab-ddr-secure   --query 'Table.SSEDescription'
# Output: Status ENABLED, SSEType KMS — meaning encryption at rest on
aws ec2 create-vpc-endpoint --vpc-id vpc-0abc --service-name com.amazonaws.ap-south-1.dynamodb   --route-table-ids rtb-0xyz --vpc-endpoint-type Gateway
# Output: VpcEndpointId vpce-… State available — private path ready

SSE on → describe → endpoint. Cleanup later.

10. Industry stories

• SaaS FGAC
• Bank CMK
• Health
• Retail
• IoT
• Gaming

11. Lab

कसं करायचं (step by step)

1. Create+SSE.
2. Put two tenants.
3. FGAC test.
4. Endpoint optional.
5. Cleanup.

Cleanup

1. Table delete.
2. Endpoint delete.
3. Confirm gone.

12. Ops checklist (ship आधी)

1. TTL attr + seconds.
2. Delete policy.
3. PITR on.
4. RPO/RTO doc.
5. Multi-region rules.
6. DAX miss path.
7. Tags.
8. Budget alert.

13. Copy-paste CLI starters

export AWS_DEFAULT_REGION=ap-south-1

# TTL status
aws dynamodb describe-time-to-live --table-name ShopApp

# PITR / continuous backups
aws dynamodb describe-continuous-backups --table-name ShopApp

# On-demand backup
aws dynamodb create-backup --table-name ShopApp --backup-name lab-shop-$(date +%Y%m%d)

# List backups
aws dynamodb list-backups --table-name ShopApp

# Global table description (v2)
aws dynamodb describe-table --table-name ShopApp --query 'Table.Replicas'

14. अजून industry stories

• Retail TTL carts
• Bank PITR drill
• Travel GT
• Gaming DAX
• Social edges
• IoT TTL

15. Glossary

16. Practice: मोठ्याने explain

1. 60s delete modes.
2. 60s PITR vs backup.
3. 60s GT.
4. 60s DAX.
5. 60s CartLite.
6. 60s social.
7. Record ×2.

17. Safe lab hygiene

• Budget alert.
• lab- prefix.
• Delete paid extras.
• GT write plan.
• Tags.
• S3 cleanup.

18. या set ची links

• Modeling
• Transactions
• Streams
• CRUD TTL
• Intro

19. Delete / archive pad

20. दहा oral drills

1. TTL units?
2. Instant?
3. PITR window?
4. GT conflict?
5. Sticky?
6. DAX vs?
7. Cart PK?
8. Lines PK?
9. Follow SK?
10. Unread GSI?

21. RPO / RTO mini workshop

1. RPO minutes.
2. RTO.
3. Map tools.
4. Drill.
5. Owner.

22. Cost watch list

• Backup storage
• GT writes
• DAX idle
• Export/S3
• TTL→Streams

23. Project Definition of Done

1. Patterns done.
2. Samples.
3. Lab hygiene.
4. Condition/txn.
5. Cleanup notes.
6. Oral.

24. Batch आतील links

• TTL→Backup
• GT→hot
• DAX after model
• P1 reuse
• P2 reuse

25. Quick self-check

1. TTL delay?
2. Soft vs hard?
3. PITR start?
4. GT no?
5. DAX≠key fix?
6. Cart keys?
7. Follow edge?
8. Cleanup habit?

26. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

27. Troubleshooting checklist

1. IAM match.
2. PK shape.
3. Wait SSE.
4. Routes.
5. CMK grants.

28. FAQ

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.