View a markdown version of this page

Example 3: Deny stream access unless a specific tag is present - Amazon DynamoDB
Using the Amazon CLIBehavior with and without Streams ABAC
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Example 3: Deny stream access unless a specific tag is present

Using the aws:TagKeys condition key, you can deny tagging a stream unless a required tag key is included in the request.

Using the Amazon CLI

  1. Add a customer managed policy to a role which has DynamoDB access, as shown in the following example.

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "dynamodb:TagResource"
      ],
      "Resource": "arn:aws:dynamodb:*:*:table/*/stream/*",
      "Condition": {
        "Null": {
          "aws:TagKeys": "false"
        },
        "ForAllValues:StringNotEquals": {
          "aws:TagKeys": "CostCenter"
        }
      }
    }
  ]
}

  2. Assume the role and attempt to tag a stream with a tag key that is not CostCenter.

    aws dynamodb tag-resource \
  --resource-arn arn:aws:dynamodb:us-east-1:123456789012:table/myMusicTable/stream/2024-01-01T00:00:00.000 \
  --tags Key=Department,Value=Engineering

Behavior with and without Streams ABAC

Without Streams ABAC

If Streams ABAC isn't enabled for your Amazon Web Services account, DynamoDB doesn't send the tag keys in the request to IAM. The Null condition ensures that the condition evaluates to false if there are no tag keys in the request. Because the Deny policy doesn't match, the tag-resource command completes successfully.

With Streams ABAC

If Streams ABAC is enabled for your Amazon Web Services account, the tag key Department is evaluated against the condition-based tag key CostCenter present in the Deny policy. The tag key Department doesn't match the tag key present in the Deny policy because of the StringNotEquals operator. Therefore, the TagResource action fails and returns an AccessDeniedException.