DynamoDB table policy blocks cross-account access

​

What this check verifies

DynamoDB tables are evaluated for resource-based policies that permit cross-account or public principals. Tables without a resource policy, or with policies restricted to the same account, are identified as isolated configurations.

​

Risk

Allowing other accounts to access a table affects:

• Confidentiality: unauthorized reads/data exfiltration
• Integrity: writes or deletes by external principals
• Availability: capacity exhaustion and throttling
• Cost: owner pays for external requests

If public principals are allowed, exposure can be unrestricted.

​

Recommendation

Apply least privilege:

• Avoid cross-account data access; if required, allow only named principals
• Constrain with aws:PrincipalOrgID, aws:SourceVpc, aws:PrincipalArn; add Deny guardrails
• Enable Block Public Access and monitor with IAM Access Analyzer

​

Remediation

​

References

• https://support.icompaas.com/support/solutions/articles/62000233614-ensure-dynamodb-tables-should-not-be-accessible-from-other-aws-accounts
• https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/access-control-resource-based.html
• https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/rbac-bpa-rbp.html

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = dynamodb_table_cross_account_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks