Give project-based access to items in DynamoDB using Cognito and IAM - amazon-web-services

Question

I use AWS Cognito as our user pool, and AWS DynamoDB for our data.
I would like to have fine-grained control over DynamoDB items (rows), on a per-user basis.
I am aware of strategies using user_id or tenant_id as the primary key, but these don't seem like they would work for my application.
The items in my database are project-based - so the partition keys are the project codes, e.g. '#PR001', '#PR002', '#PR003'.
I have different groups of users (roles) with different permissions, i.e. viewers who can read-only, editors who can edit some of the data, and super-editors who can edit all of the data.
The projects that each user has access to is not simply grouped by tenancy. For example (pseudo-code):
user_1 = {
role: "viewer",
projects: ["#PR001","#PR003","#PR005"]
}
user_2 = {
role: "editor",
projects: ["#PR002","#PR003"]
}
user_3 = {
role: "super-editor",
projects: ["#PR001","#PR005"]
}
What is the simplest approach to giving users the right type of access to only the projects they are assigned to? Would it be possible to have a item in my DDB that stores the access list for projects? Would that be secure?
NB. My user pool is small at the moment so it is not a big problem if there are some manual steps involved.

Answer 1

As the comments mention, a external fine-grained permissions solution, like Amazon Verified Permissions when generally available may offer the most flexibility.
You also can use a feature of DynamoDB to solve this. From https://www.alexdebrie.com/posts/dynamodb-transactions/#access-control
A third use case for transactions is in an authorization or access control setting.
Let's assume:
users are in USER_TABLE_NAME with user as the PK, role as the SK, and projects is a String Set of the projects related to that role.
projects are in PROJECT_TABLE_NAME with project as PK as status is green|yellow|red
The prototype (no error checks) TypeScript code below can be called via update_project("user_2", "#PR002", "red"); to update project "#PR002" to status "red" for "user_2".
The ConditionCheck in the transaction checks the user is an "editor" and the project is in the list of their projects. Only if that succeeds does the Update execute. See Amazon DynamoDB Developer Guide Managing complex workflows with DynamoDB transactions for full details.
const update_project = async function (
user: string,
project: string,
status: "green" | "yellow" | "red"
) {
const ddbResponse = await ddbClient.send(
new TransactWriteItemsCommand({
TransactItems: [
{
ConditionCheck: {
TableName: USER_TABLE_NAME,
Key: {
user: { S: user },
role: { S: "editor" },
},
ConditionExpression: "contains(projects, :project)",
ExpressionAttributeValues: {
":project": { S: project },
},
},
},
{
Update: {
TableName: PROJECT_TABLE_NAME,
Key: {
project: { S: project },
},
UpdateExpression: "SET #S = :status",
ExpressionAttributeNames: {
"#S": "status",
},
ExpressionAttributeValues: {
":status": { S: status },
},
},
},
],
})
);
};
When called using "user_1" it will fail with:
TransactionCanceledException: Transaction cancelled, please refer cancellation reasons for specific reasons [ConditionalCheckFailed, None]
You will need to update with your specific rules, allowing viewer to GetItem and editor to only update your specific fields.