Question

A company wishes to restrict access to their Amazon DynamoDB table to specific, private source IP addresses from their VPC. What should be done to secure access to the table?

Answer 1

To restrict access to an Amazon DynamoDB table to specific IP addresses within a VPC, create a VPC Endpoint for DynamoDB, use an endpoint policy to limit IPs, apply network ACLs and security groups, and configure IAM policies for table access.

Step-by-step explanation:

To secure access to an Amazon DynamoDB table and restrict it to specific, private source IP addresses within a Virtual Private Cloud (VPC), you would need to implement the following steps:

• Create a VPC Endpoint for DynamoDB within your VPC. This enables private connectivity between the VPC and DynamoDB, bypassing the public internet.
• Attach an endpoint policy that specifies the allowed source IP addresses. This policy limits access to the endpoint, and consequently the DynamoDB table, to those IPs.
• Use network Access Control Lists (ACLs) and security groups to further control inbound and outbound traffic to the endpoint.
• Ensure that the table's AWS Identity and Access Management (IAM) policies restrict access to the necessary roles or users within your organization.

By applying these layers of security, you can ensure that only the desired traffic from specific IP addresses within your VPC can access the DynamoDB table.