DVA-C03 practice question: Secrets and sensitive data (3 of 3)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A note-taking app gives signed-in users temporary AWS credentials through an Amazon Cognito identity pool.

Notes are kept in a DynamoDB table named Notes whose partition key is the user's Cognito identity ID.

The role for signed-in users allows GetItem, Query, PutItem and UpdateItem on the table, with this condition:

"Condition": { "ForAllValues:StringEquals": { "dynamodb:LeadingKeys": ["${cognito-identity.amazonaws.com:sub}"] } }

A user edits the app so that it calls GetItem for a note stored under another user's partition key.

What is the result, and why?

Choose one answer.

A. The request succeeds for reads but is denied for writes, because the condition applies only to PutItem and UpdateItem.
B. The request is denied, because the condition limits each caller to items whose partition key equals the caller's own identity ID.
C. The request succeeds, because DynamoDB applies the condition only to attributes named in a projection expression.
D. The request is denied, because the condition restricts which attributes of an item the caller may read or write.

Show the answer and explanation

Answer: B

A. Wrong: The condition sits on the one statement that allows all four actions, so it applies to reads as well as writes. Reads of another user's partition key do not match and are not allowed. Learn more: IAM conditions for DynamoDB (opens in a new tab)
B. Right: Correct. The dynamodb:LeadingKeys key holds the partition key values a request touches. The policy variable resolves to the caller's identity ID, so only that user's partition is allowed. Learn more: Item-level access by Cognito ID (opens in a new tab)
C. Wrong: Attribute-level limits use a different key, dynamodb:Attributes. LeadingKeys is checked against the partition key values that the request targets, whether or not a projection is used. Learn more: IAM conditions for DynamoDB (opens in a new tab)
D. Wrong: The result is a denial, but the reason is wrong. Controlling which attributes can be accessed is done with dynamodb:Attributes, whereas LeadingKeys limits the partition key values. Learn more: IAM conditions for DynamoDB (opens in a new tab)

Explanation

dynamodb:LeadingKeys matches the partition key values in a request, and ${cognito-identity.amazonaws.com:sub} becomes the caller's own identity ID when the policy is evaluated. A request for another user's partition key therefore falls outside what the statement allows and is denied, whichever of the four actions is used. Attribute limits are a separate condition key.

DVA-C03 practice question: Secrets and sensitive data (3 of 3)

Explanation

Study

Keep practicing