cis-aws-database-4-2

name	cis-aws-database-4.2
description	Ensure Fine-Grained Access Control is implemented
category	cis-database
version	2.0.0
author	cyberstrike-official
tags	["cis","aws","database","dynamodb","iam","fgac","access-control"]
cis_id	4.2
cis_benchmark	CIS AWS Database Services Benchmark v2.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-database-4.1"]
prerequisites	[]
severity_boost	{}

4.2 Ensure Fine-Grained Access Control is implemented

Description

Fine-Grained Access Control (FGAC) on Amazon DynamoDB allows you to control access to data at the row level. Using IAM policies, you can restrict access based on the content within the request. Here is how you can implement FGAC:

Rationale

Fine-Grained access control helps users to create and allow specific permission within that DB.

Impact

N/A

Audit Procedure

Using AWS Console

1. Create an IAM Role

   • Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
   • In the navigation pane, choose Roles and select Create role.
   • Choose AWS service as the type of trusted entity.
   • Choose DynamoDB as the service that will use this role, then click Next: Permissions.
   • On the Attach permissions policies page, choose Next: Tags. You do not need to attach a policy to this role yet.
   • On the Add tags page, choose Next: Review.
   • On the Review page, for Role name, enter a name for your role, such as DynamoDBFineGrainedAccessRole.
   • Choose Create role.

2. Create an IAM Policy for Fine-Grained Access Control

   • In the navigation pane, choose Policies and select Create policy.
   • Choose the JSON tab.
   • Paste the following policy into the policy document field, replacing us-west-2, 123456789012, myddbtable, HK, and RANGEK with your own values:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect"