Using custom attribute values to restrict access to dynamo DB rows

Viewed 104

I need to restrict a users access to only rows from tables keyed by a unique ID which is used as the primary key in dynamo DB.

This unique ID is present in the JWT from the OIDC provider but the issue is that IAM doesn't allow custom attributes to be used to restrict access to Leading Keys.

Does anyone know if it is possible to do this via some sort of workaround like mapping the custom attribute to a value that can be used in an IAM policy?

I need to do something like the following:

"ForAllValues:StringEquals": {
                    "dynamodb:LeadingKeys": [
                        "${cognito-identity.amazonaws.com:my_unique_id}"
                    ],
                    "dynamodb:Attributes": [
                        "UserId",
                        "GameTitle",
                        "Wins",
                        "Losses",
                        "TopScore",
                        "TopScoreDateTime"
                    ]
                },
0 Answers
Related