DynamoDB Streams Can Now Be Locked Down With Just Tags!

Hey there, it's Shiichan! Today's news makes managing DynamoDB access a little smarter, let's dive in!

AWS What's New aws.amazon.com

What was announced?

This comes from AWS What's New. Amazon DynamoDB Streams now supports attribute-based access control (ABAC). You can use tag-based conditions in your IAM policies to control access to your data streams.

The story so far

You could already tag DynamoDB tables themselves, but there was no way to control access to Streams on their own with tags. When multiple teams or applications shared DynamoDB Streams in the same account, separating access by environment or team meant writing a separate, fine-grained IAM policy for every single stream.

What changes

Now you can attach up to 50 tags to each stream and use those tags in IAM policy conditions. For example, you can allow reads only from streams tagged "environment:production" while restricting access to other environments, all through a single policy.

Stream tags are managed independently from their parent table's tags, so you can keep the table as-is while controlling stream access more precisely. Teams running DynamoDB across multiple teams or environments should be able to cut down on the number of IAM policies they maintain.

Dive Deep

This is available in all commercial AWS Regions and AWS GovCloud (US) Regions where DynamoDB Streams is supported, at no additional cost. If you're already using Streams, you can adopt this simply by tagging your streams and updating your IAM policy conditions.

Wrap-up

• DynamoDB Streams now supports attribute-based access control (ABAC)
• Attach up to 50 tags per stream and use them in IAM policy conditions
• Stream tags are managed independently from table tags
• Available in all commercial Regions and GovCloud (US), at no extra cost

A great fit for teams running DynamoDB Streams across multiple teams or environments who want to simplify their IAM policy sprawl!