How to use DynamoDB fine grained access control with Cognito User Pools? : <p>I'm having trouble understanding how to use fine-grained access control on DynamoDB when logged in using Cognito User Pools. I've followed the docs and googled around, but for some reason I can't seem to get it working.</p>

<p>My AWS setup is listed below. If I remove the condition in the role policy, I can get and put items no problem, so it seems likely that the condition is the problem. But I can't figure out how or where to debug policies that depend on authenticated identities - what variables are available, what are their values, etc etc.</p>

<p>Any help would be greatly appreciated!</p>

<p><strong>DynamoDB table</strong></p>

<ul>
<li>Table name: documents</li>
<li>Primary partition key: userID (String)</li>
<li>Primary sort key: docID (String)</li>
</ul>

<p><strong>DynamoDB example row</strong></p>

<pre><code>{
  "attributes": {},
  "docID": "0f332745-f749-4b1a-b26d-4593959e9847",
  "lastModifiedNumeric": 1470175027561,
  "lastModifiedText": "Wed Aug 03 2016 07:57:07 GMT+1000 (AEST)",
  "type": "documents",
  "userID": "4fbf0c06-03a9-4cbe-b45c-ca4cd0f5f3cb"
}
</code></pre>

<p><strong>Cognito User Pool User</strong></p>

<ul>
<li>User Status: Enabled / Confirmed</li>
<li>MFA Status: Disabled</li>
<li>sub: 4fbf0c06-03a9-4cbe-b45c-ca4cd0f5f3cb</li>
<li>email_verified: true</li>
</ul>

<p><strong>Role policy for "RoleName"</strong></p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:GetItem",
                "dynamodb:PutItem"
            ],
            "Resource": [
                "arn:aws:dynamodb:ap-southeast-2:NUMBER:table/documents"
            ],
            "Condition": {
                "ForAllValues:StringEquals": {
                    "dynamodb:LeadingKeys": [
                        "${cognito-identity.amazonaws.com:sub}"
                    ]
                }
            }
        }
    ]
}
</code></pre>

<p><strong>Login information returned from cognitoUser.getUserAttributes()</strong></p>

<pre><code>attribute sub has value 4fbf0c06-03a9-4cbe-b45c-ca4cd0f5f3cb
attribute email_verified has value true
attribute email has value ****@****com
</code></pre>

<p><strong>Error message</strong></p>

<pre><code>Code: "AccessDeniedException"
Message: User: arn:aws:sts::NUMBER:assumed-role/ROLE_NAME/CognitoIdentityCredentials is not authorized to perform: dynamodb:GetItem on resource: arn:aws:dynamodb:ap-southeast-2:NUMBER:table/documents
</code></pre>
