AmazonDynamoDBReadOnlyAccess

Summary

Provides read only access to Amazon DynamoDB via the AWS Management Console. The Amazon DynamoDB Developer Guide says it grants read-only access to Amazon DynamoDB, with read-only access to DynamoDB Accelerator (DAX) and view access to related services.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccessCopy ARN

Default version

v15

Created

2015-02-06

Last edited

2024-11-18

Services

application-autoscaling, cloudwatch, datapipeline, dax, dynamodb, ec2, iam, kinesis, kms, lambda, resource-groups, sns, tag

Control-plane actions (71)

By access level: 25 List, 46 Read.

Data-plane actions (8)

By access level: 1 List, 7 Read.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants only List and Read actions.

Guidance

Related policies

Same service

• AmazonDynamoDBFullAccess
• AmazonDynamoDBFullAccess_v2
• AmazonDynamoDBFullAccesswithDataPipeline
• AmazonEC2RoleforDataPipelineRole
• AmazonElasticMapReduceforEC2Role
• AWSApplicationAutoscalingDynamoDBTablePolicy
• AWSElasticBeanstalkRoleWorkerTier
• AWSIoTRuleActions

Same domain

• AmazonAuroraDSQLConsoleFullAccess
• AmazonAuroraDSQLFullAccess
• AmazonAuroraDSQLReadOnlyAccess
• AmazonDocDBConsoleFullAccess
• AmazonDocDBElasticFullAccess
• AmazonDocDBElasticReadOnlyAccess
• AmazonDocDBFullAccess
• AmazonDocDBReadOnlyAccess

Frequently asked questions

When should I attach AmazonDynamoDBReadOnlyAccess?

The Amazon DynamoDB Developer Guide says you can attach it to your IAM identities and that it grants read-only access to Amazon DynamoDB. Attach it where reading DynamoDB tables is the intended scope. For narrower access, AWS recommends custom policies that grant least privilege.

What does AmazonDynamoDBReadOnlyAccess grant?

It allows dynamodb:GetItem, dynamodb:BatchGetItem, dynamodb:Query, dynamodb:Scan, dynamodb:PartiQLSelect, dynamodb:Describe* and dynamodb:List*, the DAX equivalents, and describe and list actions for related services such as Application Auto Scaling, CloudWatch, AWS KMS and Kinesis, on all resources.

What are the security risks of AmazonDynamoDBReadOnlyAccess?

It reads item data from every table (dynamodb:Scan, dynamodb:Query) and from DAX clusters. AWS recommends custom IAM policies that grant least privilege, and updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "GeneralReadOnlyAccess",
      "Action": [
        "application-autoscaling:DescribeScalableTargets",
        "application-autoscaling:DescribeScalingActivities",
        "application-autoscaling:DescribeScalingPolicies",
        "cloudwatch:DescribeAlarmHistory",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:DescribeAlarmsForMetric",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "cloudwatch:GetMetricData",
        "datapipeline:DescribeObjects",
        "datapipeline:DescribePipelines",
        "datapipeline:GetPipelineDefinition",
        "datapipeline:ListPipelines",
        "datapipeline:QueryObjects",
        "dynamodb:BatchGetItem",
        "dynamodb:Describe*",
        "dynamodb:List*",
        "dynamodb:GetAbacStatus",
        "dynamodb:GetItem",
        "dynamodb:GetResourcePolicy",
        "dynamodb:Query",
        "dynamodb:Scan",
        "dynamodb:PartiQLSelect",
        "dax:Describe*",
        "dax:List*",
        "dax:GetItem",
        "dax:BatchGetItem",
        "dax:Query",
        "dax:Scan",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups",
        "iam:GetRole",
        "iam:ListRoles",
        "kms:DescribeKey",
        "kms:ListAliases",
        "sns:ListSubscriptionsByTopic",
        "sns:ListTopics",
        "lambda:ListFunctions",
        "lambda:ListEventSourceMappings",
        "lambda:GetFunctionConfiguration",
        "resource-groups:ListGroups",
        "resource-groups:ListGroupResources",
        "resource-groups:GetGroup",
        "resource-groups:GetGroupQuery",
        "tag:GetResources",
        "kinesis:ListStreams",
        "kinesis:DescribeStream",
        "kinesis:DescribeStreamSummary"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Sid": "CCIAccess",
      "Action": "cloudwatch:GetInsightRuleReport",
      "Effect": "Allow",
      "Resource": "arn:aws:cloudwatch:*:*:insight-rule/DynamoDBContributorInsights*"
    }
  ]
}

Version history

Current version v15, edited by AWS on 2024-11-18. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess

resource "aws_iam_role_policy_attachment" "amazondynamodbreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonDynamoDBReadOnlyAccess"),
);

Sources

• AmazonDynamoDBReadOnlyAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-12; supports summary, practicalScope, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for Amazon DynamoDB (Amazon DynamoDB Developer Guide) (retrieved 2026-11-12; supports summary, useCases, assignmentGuidance, faqs)
• Using identity-based policies (IAM policies) for Amazon DynamoDB (Amazon DynamoDB Developer Guide) (retrieved 2026-11-12; supports bestPractices, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)

• Official AWS reference for AmazonDynamoDBReadOnlyAccess
• AWS service guide
• Report a data issue