# Ensure Fine-Grained Access Control is implemented

- Source: https://support.icompaas.com/support/solutions/articles/62000234466-ensure-fine-grained-access-control-is-implemented
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS AWS Database Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112688) › [CIS AWS Database Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169253)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**  

-   **Level 1**

**Description:** Fine-Grained Access Control (FGAC) restricts access to individual items or attributes within database tables using IAM policy conditions such as dynamodb:LeadingKeys or dynamodb:Attributes. This allows different users or applications to access only the data they are authorized to see.

**Rationale:** FGAC enforces the principle of least privilege at the data level, reducing the risk of unauthorized data exposure. It’s especially critical for multi-tenant applications or sensitive datasets where row-level or attribute-level isolation is required.

**Impact:  
 Pros:**

-   Provides granular security controls  
    
-   Enables tenant or user-specific data access  
    
-   Reduces lateral access in shared tables  
    

**Cons:**

-   Increases complexity in policy authoring and testing  
    
-   Misconfigured conditions may unintentionally block or allow access  
    

**Default Value:** IAM access to DynamoDB and Timestream tables is not fine-grained by default. Policies must be explicitly created with condition elements.

**Pre-requisites:**

-   An existing DynamoDB or Timestream database  
    
-   IAM permissions to create and attach custom policies  
    
-   Understanding of dynamodb:LeadingKeys, dynamodb:Attributes, or similar IAM conditions  
    

**Remediation:**

### **Test Plan**

**Using AWS Console:**

1.  Sign in to the AWS Console  
    
2.  Navigate to IAM > Policies  
    
3.  Review policies attached to roles accessing DynamoDB or Timestream  
    
4.  Confirm the use of condition keys like dynamodb:LeadingKeys or dynamodb:Attributes  
    
5.  Verify that access is scoped to specific items or attributes  
    

**Using AWS CLI:**

1.  List attached role policies:  
    
    aws iam list-attached-role-policies --role-name <role-name>
    
      
    
2.  Retrieve the policy document:  
    
     aws iam get-policy-version --policy-arn <policy-arn> --version-id <version-id>
    
3.  Verify presence of condition blocks like:  
    
     "Condition": { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": \["${aws:username}"\] } }
    

### **Implementation Plan**

**Using AWS Console:**

1.  Navigate to IAM > Policies > Create Policy  
    
2.  Select JSON tab  
    
3.  Define a policy using dynamodb:LeadingKeys or dynamodb:Attributes  
    
4.  Name the policy (e.g., DynamoDBFineGrainedPolicy)  
    
5.  Go to Roles > YourRole > Attach policies  
    
6.  Attach the newly created fine-grained policy  
    

**Using AWS CLI:**

1.  Create the policy:  
    
     aws iam create-policy --policy-name DynamoDBFineGrainedPolicy --policy-document file://fine\_grained\_policy.json
    
2.  Attach the policy to a role:  
    
     aws iam attach-role-policy --role-name <role-name> --policy-arn arn:aws:iam::<account-id>:policy/DynamoDBFineGrainedPolicy
    

### **Backout Plan**

**Using AWS Console:**

1.  Go to IAM > Roles > YourRole  
    
2.  Click Permissions > Detach policies  
    
3.  Uncheck DynamoDBFineGrainedPolicy and click Remove
    
4.  Navigate to IAM > Policies, select and delete the policy  
    

**Using AWS CLI:**

1.  Detach the policy:  
    
    aws iam detach-role-policy --role-name <role-name> --policy-arn arn:aws:iam::<account-id>:policy/DynamoDBFineGrainedPolicy
    
2.  Delete the policy:  
    
     aws iam delete-policy --policy-arn arn:aws:iam::<account-id>:policy/DynamoDBFineGrainedPolicy
    

**References:**

-   [amazondynamodb](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html)  
    
-   [](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html)[IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.