AmazonDynamoDBFullAccess

Summary

Provides full access to Amazon DynamoDB via the AWS Management Console. The Amazon DynamoDB Developer Guide says this policy is deprecated and no longer recommended, and that it was replaced by a scoped-down policy named AmazonDynamoDBFullAccess_v2.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AmazonDynamoDBFullAccessCopy ARN

Default version

v15

Created

2015-02-06

Last edited

2021-01-29

Services

application-autoscaling, cloudwatch, datapipeline, dax, dynamodb, ec2, iam, kinesis, kms, lambda, resource-groups, sns, tag

Control-plane actions (154)

By access level: 26 List, 4 Permissions management, 48 Read, 4 Tagging, 72 Write.

Data-plane actions (20)

By access level: 1 List, 11 Read, 8 Write.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants at least 80% of the write and permissions-management actions of: dax (16 of 16), dynamodb (45 of 45).
• Grants data-plane write actions on a data store on all resources without conditions.
• Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).
• 13 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them.

Guidance

Related policies

Same service

• AmazonAppStreamFullAccess
• AmazonDynamoDBFullAccess_v2
• AmazonDynamoDBFullAccesswithDataPipeline
• AmazonDynamoDBReadOnlyAccess
• AmazonEC2RoleforDataPipelineRole
• AmazonECS_FullAccess
• AmazonECSInfrastructureRoleforExpressGatewayServices
• AmazonElasticMapReduceforEC2Role

Same domain

• AdministratorAccess
• AdministratorAccess-Amplify
• AIDevOpsAgentActionsPolicy
• AmazonDataZoneProjectDeploymentPermissionsBoundary
• AmazonEC2RoleforSSM
• AmazonElasticMapReduceFullAccess
• AmazonElasticMapReduceRole
• AmazonElasticTranscoderRole

Frequently asked questions

When should I attach AmazonDynamoDBFullAccess?

The Amazon DynamoDB Developer Guide says AmazonDynamoDBFullAccess is deprecated and no longer recommended, and names AmazonDynamoDBFullAccess_v2 as the scoped-down replacement. If you already use it, review whether the v2 policy or a customer managed policy fits.

What does AmazonDynamoDBFullAccess grant?

It allows dynamodb:* and dax:* on all resources, plus related actions for Application Auto Scaling, CloudWatch alarms, AWS Data Pipeline, Amazon EC2 and IAM reads, AWS KMS reads, Amazon SNS topics, Lambda functions, AWS Resource Groups, tagging and Kinesis reads. It also allows iam:PassRole to Application Auto Scaling and dax.amazonaws.com, and creating service-linked roles for named services.

What are the security risks of AmazonDynamoDBFullAccess?

dynamodb:* and dax:* allow every DynamoDB and DAX action on all resources, together with delete actions such as lambda:DeleteFunction and sns:DeleteTopic. The policy is deprecated. AWS recommends custom IAM policies that grant least privilege, and updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "dynamodb:*",
        "dax:*",
        "application-autoscaling:DeleteScalingPolicy",
        "application-autoscaling:DeregisterScalableTarget",
        "application-autoscaling:DescribeScalableTargets",
        "application-autoscaling:DescribeScalingActivities",
        "application-autoscaling:DescribeScalingPolicies",
        "application-autoscaling:PutScalingPolicy",
        "application-autoscaling:RegisterScalableTarget",
        "cloudwatch:DeleteAlarms",
        "cloudwatch:DescribeAlarmHistory",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:DescribeAlarmsForMetric",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "cloudwatch:PutMetricAlarm",
        "cloudwatch:GetMetricData",
        "datapipeline:ActivatePipeline",
        "datapipeline:CreatePipeline",
        "datapipeline:DeletePipeline",
        "datapipeline:DescribeObjects",
        "datapipeline:DescribePipelines",
        "datapipeline:GetPipelineDefinition",
        "datapipeline:ListPipelines",
        "datapipeline:PutPipelineDefinition",
        "datapipeline:QueryObjects",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups",
        "iam:GetRole",
        "iam:ListRoles",
        "kms:DescribeKey",
        "kms:ListAliases",
        "sns:CreateTopic",
        "sns:DeleteTopic",
        "sns:ListSubscriptions",
        "sns:ListSubscriptionsByTopic",
        "sns:ListTopics",
        "sns:Subscribe",
        "sns:Unsubscribe",
        "sns:SetTopicAttributes",
        "lambda:CreateFunction",
        "lambda:ListFunctions",
        "lambda:ListEventSourceMappings",
        "lambda:CreateEventSourceMapping",
        "lambda:DeleteEventSourceMapping",
        "lambda:GetFunctionConfiguration",
        "lambda:DeleteFunction",
        "resource-groups:ListGroups",
        "resource-groups:ListGroupResources",
        "resource-groups:GetGroup",
        "resource-groups:GetGroupQuery",
        "resource-groups:DeleteGroup",
        "resource-groups:CreateGroup",
        "tag:GetResources",
        "kinesis:ListStreams",
        "kinesis:DescribeStream",
        "kinesis:DescribeStreamSummary"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": "cloudwatch:GetInsightRuleReport",
      "Effect": "Allow",
      "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*"
    },
    {
      "Action": [
        "iam:PassRole"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "iam:PassedToService": [
            "application-autoscaling.amazonaws.com",
            "application-autoscaling.amazonaws.com.cn",
            "dax.amazonaws.com"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:CreateServiceLinkedRole"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": [
            "replication.dynamodb.amazonaws.com",
            "dax.amazonaws.com",
            "dynamodb.application-autoscaling.amazonaws.com",
            "contributorinsights.dynamodb.amazonaws.com",
            "kinesisreplication.dynamodb.amazonaws.com"
          ]
        }
      }
    }
  ]
}

Version history

Current version v15, edited by AWS on 2021-01-29. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess

resource "aws_iam_role_policy_attachment" "amazondynamodbfullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonDynamoDBFullAccess"),
);

Sources

• AmazonDynamoDBFullAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-12; supports summary, practicalScope, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for Amazon DynamoDB (Amazon DynamoDB Developer Guide) (retrieved 2026-11-12; supports summary, useCases, securityConsiderations, assignmentGuidance, faqs)
• Using identity-based policies (IAM policies) for Amazon DynamoDB (Amazon DynamoDB Developer Guide) (retrieved 2026-11-12; supports useCases, bestPractices, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)

• Official AWS reference for AmazonDynamoDBFullAccess
• AWS service guide
• Report a data issue