DynamoDB integrates with IAM to control access to both the service and the data in the tables. There will be two types of access for DynamoDB granted to our IAM users:
- Administrative access: IAM users or roles with permissions to create and modify DynamoDB tables
- Data access: IAM users or roles with specific permissions to read, write, update, or delete items in one specific table
When designing your application, you can therefore give the code the ability to provision its own tables; this is very useful when your application works in cycles.
For example, an application that records sessions could be trusted to automatically create a new sessions table at the start of the day, and remove the old sessions table from the previous day. This would keep the DynamoDB table lean and clean as there would never be any session data more than 24 hours...