Access to Dynamo D-B is controlled are the ADA because I am cereus our identity and access management
service in I am very heavy users use aggressives rolls and then we apply policies these uses cribs our
roles to control their access to defriended of US resources our services and we agreed that users roles
as well as policies through this course just for the sake of clarity.
A user can be created with an I am and it can either be a real user who can log into the console using
the username and password or it can be a service user also a as an API user which can access AWOS only
through API using the access credentials like the API key and secret access key access using username
and password is generally for real human users who need to log into the aid of us console by API users
are generally used by the applications that interact with AWOS programmatically.
And then we have Rose roles can be assigned access policies just like users but the roles can be as
seen by users.
Applications are either aid or services without actually having to use additional access credentials.
We use drones in several demos in this course for example we use drones for land that function which
allowed a land to interact with Dynamo dynamically cloud watch on our behalf.
And we did not have to create any access keys for land in order to give it the necessary access set
rules allow us to delegate access to the resources without having to use long term access keys.
We have already created an API user named dynamo be training to interact with dynamically programmatically.
Let's open this user in.
I am and we can see that the user currently has full access to cloud search and dynamically and also
has access to S-3.
If we wanted to give this user only real access and no right access read changed change their policy
accordingly.
So let's remove Danimal D-B full access and add dynamically read access
just like that.
And now if we try to run a write operation it should fail.
But real operations should still work.
So let's try that out.
I open the sandbox project inside me as code and I'm going to run read up chess
and it works.
Now let's run right up star.
And we see that we get access denied.
Exception making Forder fine tune this policy set.
I'm going to remove the read only access policy.
And give this user access to just the get item operation.
I have removed the policy.
Then click on Add in line policy lets choose dynamo dynamically
under actions.
Open the read section and select get item for resources.
I'm going to say all resources
now.
Every real the JS and we can see that this policy allows get item access to all resources continue
and name the policies.
A custom dynamo VB policy and create.
Now if we run the get item operation it should work
and it does let's run batch get item operation
and it face as expected.
Let's run get item on another table say Tiede next.
DK
and it works as well.
Now let's limit the user with get item access only to the test table.
So I'm going to copy the table area for the TV you know stable for the over wheel tab in the dynamo
or the console and then let's end it our custom policy
expanded and click on added
under-resourcing select specific and and and that we just copied just like that to review all to see
and say now if we run get item operation on any other table than the notes desk table it should fail.
And a Des's Let's write on the DD node.
Best table.
And it works as expected.
Now we can control access at a fine grained and level set.
We can't even tell us to allow this user or role to access certain items within the table and not only
and not any other items.
Let's end this policy again and this time would specify the request conditions we can enforce MFA device
based access or allow access only from certain white listed IP addresses as well.
The ADD condition
less select condition Dynamo the leading case for all who Alli's in the Asked operator as string equals
and value as a word this SES is allow this user to access items from the table where partition key is
equal to a
say.
If we run our code now it works.
But if a change partition key from a to b for example and it we get access denied exception
we can add different conditions to even control which attributes can be accessed within an item and
so on.
And this is typically full especially when we want application users to be able to access their own
data but they should not be allowed to access the information about other users of the application.
So instead of hard coding the partition key we can't even use substitution variables are expressions
here.
For example we could say dollar curly braces AWOS colon username and this will provide access to the
user only if the partition key value matches that AWOS username
now if we test our code it should fail.
And it does not.
Just to demonstrate this.
I'm going to create a few items with username of this API user as the partition key say inside the dynamo
IDB console.
Let's duplicate an item and change the user id to Dynamo the HIF in training.
This is the username of our API user and let's create one more item with a different sort key.
Now let's run get items for these items.
And it works awesome.
That's all about fine grained access control in Dynamo D-B.
We used the graphical editors and you can also simply based policy and Jason format if you like just
as we did in several demos earlier in this course.
All right before we continue let's remove the fine grained access control policy and get our API user
full access to Dynamo ODBC.
We can complete the rest of the demos with Edes so inside I am I'm going to remove the custom dynamo
D-B policy and add back the full Dynamo the access policy
just like that awesome.
In the next section we are going to build a rest API using node and express to interact with our dynamo
D-MI table and later in the course will use this API to integrate Front-End web application with our
dynamo Leavey back and to create an end to end solution.
We'll also integrate this API with a mobile app that is an I O S and an Android app.
So let's keep going.