Profile Applicability
Level 1
Description
Enable fine-grained access control (FGAC) in database services such as Amazon Timestream and DynamoDB to limit access at the table, row, or column level based on user roles or conditions. This enhances data confidentiality and aligns with the principle of least privilege.
Rationale
Enforcing FGAC allows organizations to apply stricter access control by granting users access only to the data they are authorized to interact with. This minimizes potential exposure and misuse of sensitive data.
Impact
While this adds security, it increases complexity in managing IAM policies. Misconfiguration could result in access issues or unintentional exposure.
Default Value
By default, FGAC is not enabled in services like Timestream or DynamoDB. IAM policies must be explicitly configured to enforce it.
Pre-Requisites
IAM roles and policies must be configured and attached to users or services.
Services like Amazon Timestream or DynamoDB must be in use.
Remediation
Test Plan
Review IAM policies applied to database users.
Verify that permissions are scoped to specific resources (tables, columns, rows).
Check for use of condition keys like dynamodb:LeadingKeys or Timestream resource conditions.
Validate that unauthorized users cannot access restricted data via tests or simulations.
Implementation Plan
Using AWS Console
Go to the IAM console.
Choose Policies and create a new policy.
Use the JSON editor to define fine-grained rules (e.g., restrict actions on certain rows/tables).
Attach this policy to the appropriate IAM user, group, or role.
If using DynamoDB:
Define condition keys like dynamodb:LeadingKeys.
If using Timestream:
Use resource-level permissions for tables, columns, and rows.
Using AWS CLI
Create the IAM policy:
aws iam create-policy --policy-name DynamoDBFGACPolicy --policy-document file://fgac-policy.json
Attach the policy to a role:
aws iam attach-role-policy --role-name MyFGACRole --policy-arn arn:aws:iam::<account-id>:policy/DynamoDBFGACPolicy
Use condition keys in your policy JSON like:
"Condition": { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["${aws:username}"] } }
Backout Plan
Using AWS Console
Navigate to the IAM console.
Detach the fine-grained policy from the user/role.
Delete the custom IAM policy if no longer needed.
Using AWS CLI
Detach policy:
aws iam detach-role-policy --role-name MyFGACRole --policy-arn arn:aws:iam::<account-id>:policy/DynamoDBFGACPolicy
Delete policy:
aws iam delete-policy --policy-arn arn:aws:iam::<account-id>:policy/DynamoDBFGACPolicy