AmazonDynamoDBFullAccesswithDataPipeline

Summary

Provides full access to Amazon DynamoDB including Export/Import using AWS Data Pipeline via the AWS Management Console. The reference page description says this policy is on a deprecation path.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AmazonDynamoDBFullAccesswithDataPipelineCopy ARN

Default version

v2

Created

2015-02-06

Last edited

2015-11-12

Services

cloudwatch, datapipeline, dynamodb, ec2, elasticmapreduce, iam, lambda, s3, sns

Control-plane actions (423)

By access level: 66 List, 25 Permissions management, 138 Read, 12 Tagging, 182 Write.

Data-plane actions (52)

By access level: 4 List, 2 Permissions management, 19 Read, 2 Tagging, 25 Write.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants at least 80% of the write and permissions-management actions of: datapipeline (11 of 11), dynamodb (45 of 45), elasticmapreduce (54 of 54), lambda (76 of 76).
• Grants data-plane write actions on a data store on all resources without conditions.
• Grants iam:PassRole on all resources without conditions.
• 17 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them.

Guidance

Related policies

Same service

• AccessAnalyzerServiceRolePolicy
• AdministratorAccess-AWSElasticBeanstalk
• AmazonAppFlowFullAccess
• AmazonAppStreamServiceAccess
• AmazonBedrockStudioPermissionsBoundary
• AmazonBraketJobsExecutionPolicy
• AmazonBraketServiceRolePolicy
• AmazonCloudWatchEvidentlyFullAccess

Same domain

• AdministratorAccess
• AdministratorAccess-Amplify
• AIDevOpsAgentActionsPolicy
• AmazonDataZoneProjectDeploymentPermissionsBoundary
• AmazonDynamoDBFullAccess
• AmazonDynamoDBFullAccess_v2
• AmazonEC2RoleforDataPipelineRole
• AmazonEC2RoleforSSM

Frequently asked questions

When should I attach AmazonDynamoDBFullAccesswithDataPipeline?

Its description says it provides full access to DynamoDB including export and import with AWS Data Pipeline via the console, and that the policy is on a deprecation path. If you already use it, review whether a current DynamoDB policy or a customer managed policy fits.

What does AmazonDynamoDBFullAccesswithDataPipeline grant?

It allows dynamodb:*, lambda:*, datapipeline:* and elasticmapreduce:* on all resources, CloudWatch alarm actions, SNS topic and subscription actions, EC2 instance launch, start, stop and terminate actions, iam:ListRoles, iam:GetRolePolicy and iam:PassRole, and S3 delete, get, list and put actions, all on all resources.

What are the security risks of AmazonDynamoDBFullAccesswithDataPipeline?

It allows iam:PassRole on all resources with no condition, lambda:*, datapipeline:* and elasticmapreduce:*, EC2 terminate actions, and S3 put and delete actions on all resources. The description says the policy is on a deprecation path. AWS managed policies do not grant least privilege permissions, and AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "cloudwatch:DeleteAlarms",
        "cloudwatch:DescribeAlarmHistory",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:DescribeAlarmsForMetric",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "cloudwatch:PutMetricAlarm",
        "dynamodb:*",
        "sns:CreateTopic",
        "sns:DeleteTopic",
        "sns:ListSubscriptions",
        "sns:ListSubscriptionsByTopic",
        "sns:ListTopics",
        "sns:Subscribe",
        "sns:Unsubscribe",
        "sns:SetTopicAttributes"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "DDBConsole"
    },
    {
      "Action": [
        "lambda:*",
        "iam:ListRoles"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "DDBConsoleTriggers"
    },
    {
      "Action": [
        "datapipeline:*",
        "iam:ListRoles"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "DDBConsoleImportExport"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:GetRolePolicy",
        "iam:PassRole"
      ],
      "Resource": [
        "*"
      ],
      "Sid": "IAMEDPRoles"
    },
    {
      "Action": [
        "ec2:CreateTags",
        "ec2:DescribeInstances",
        "ec2:RunInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:TerminateInstances",
        "elasticmapreduce:*",
        "datapipeline:*"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "EMR"
    },
    {
      "Action": [
        "s3:DeleteObject",
        "s3:Get*",
        "s3:List*",
        "s3:Put*"
      ],
      "Effect": "Allow",
      "Resource": [
        "*"
      ],
      "Sid": "S3"
    }
  ]
}

Version history

Current version v2, edited by AWS on 2015-11-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBFullAccesswithDataPipeline
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBFullAccesswithDataPipeline
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBFullAccesswithDataPipeline

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonDynamoDBFullAccesswithDataPipeline

resource "aws_iam_role_policy_attachment" "amazondynamodbfullaccesswithdatapipeline" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccesswithDataPipeline"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonDynamoDBFullAccesswithDataPipeline"),
);

Sources

• AmazonDynamoDBFullAccesswithDataPipeline (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, useCases, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)

• Official AWS reference for AmazonDynamoDBFullAccesswithDataPipeline
• Report a data issue