How to fix AccessDeniedException: User is not authorized to perform dynamodb:GetItem in DynamoDB

DynamoDBINTERMEDIATEHIGH

This error occurs when your IAM role or user lacks the necessary permissions to perform operations on a DynamoDB table. The fix requires attaching the correct IAM policies with appropriate DynamoDB actions.

What this error means

The AccessDeniedException indicates that AWS Identity and Access Management (IAM) has blocked your request because the credentials you're using don't have permission to perform the requested DynamoDB operation. DynamoDB uses IAM to control access to tables and operations, requiring explicit permissions for each action like GetItem, PutItem, Query, or Scan. When you attempt to access a DynamoDB table, AWS evaluates your IAM policies to determine whether you have the necessary permissions. If your IAM user, role, or the associated policies don't explicitly grant access to the specific DynamoDB action and resource, AWS denies the request and returns an AccessDeniedException. This error is part of AWS's security model that follows the principle of least privilege—by default, all access is denied unless explicitly allowed. This means you must configure IAM policies to grant the exact permissions your application needs.

How to fix "AccessDeniedException: User is not authorized to perform dynamodb:GetItem"

1Verify the IAM role or user being used

First, identify which IAM credentials are making the request. For Lambda functions, check the execution role. For EC2 instances, check the instance profile role. For local development, check your AWS CLI configuration.

bash

# Check current AWS identity
aws sts get-caller-identity

# This returns the User ARN, Account, and User ID

Note the ARN shown—this is the identity that needs DynamoDB permissions.

2Review current IAM policies

Examine the IAM policies attached to your user or role to see what DynamoDB permissions are currently granted.

bash

# List policies attached to a role
aws iam list-attached-role-policies --role-name YourRoleName

# Get policy details
aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/YourPolicyName --version-id v1

Look for statements that include dynamodb:GetItem or dynamodb:* actions. Check if the Resource ARN matches your table.

3Attach the required DynamoDB permissions

Create or update an IAM policy to grant the necessary DynamoDB permissions. For basic read access:

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:Query",
        "dynamodb:Scan"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/YourTableName"
    }
  ]
}

For write operations, add actions like dynamodb:PutItem, dynamodb:UpdateItem, dynamodb:DeleteItem.

Attach this policy to your IAM role:

bash

aws iam put-role-policy --role-name YourRoleName --policy-name DynamoDBAccess --policy-document file://dynamodb-policy.json

Replace the region, account ID, and table name with your actual values.

4Verify the DynamoDB table ARN and region

Ensure your IAM policy references the correct table ARN and region. A common mistake is referencing the wrong region.

bash

# Get table information including ARN
aws dynamodb describe-table --table-name YourTableName --region us-east-1

The table ARN format is: arn:aws:dynamodb:region:account-id:table/table-name

If your application runs in us-west-2 but your policy specifies us-east-1, the permissions won't apply.

5Check for VPC endpoint policies if using VPC

If your application runs in a VPC and uses a VPC endpoint for DynamoDB, verify the endpoint policy allows the required actions.

bash

# List VPC endpoints
aws ec2 describe-vpc-endpoints --filters Name=service-name,Values=com.amazonaws.us-east-1.dynamodb

The VPC endpoint policy must allow DynamoDB operations. If it's restrictive, update it to permit your required actions:

json

{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:Query",
        "dynamodb:Scan"
      ],
      "Resource": "*"
    }
  ]
}

6Test the permissions

After updating the IAM policies, test your access to the DynamoDB table.

bash

# Test GetItem operation
aws dynamodb get-item \
  --table-name YourTableName \
  --key '{"id": {"S": "test-id"}}' \
  --region us-east-1

If you still get AccessDeniedException, wait a few seconds for IAM policy changes to propagate, then try again. IAM changes are eventually consistent and may take up to 5 seconds to take effect.

How to fix AccessDeniedException: User is not authorized to perform dynamodb:GetItem in DynamoDB

What this error means

Typical symptoms

Common causes

How to fix "AccessDeniedException: User is not authorized to perform dynamodb:GetItem"

Advanced notes

Related errors

Official resources & further reading