I'm currently experimenting with [Amazon DynamoDB](http://aws.amazon.com/dynamodb/) to create a full JavaScript application directly in browser using the [AWS SDK for JavaScript in the Browser](http://aws.amazon.com/sdkforbrowser/).
But, I can't manage to secure access to DynamoDB.

In `IAM` I created a Group named `Users` with this policy :

```js
{
  "Version": "2012-10-17",
  "Statement": [{
      "Effect": "Allow",
      "Action": [
        "dynamodb:BatchGetItem",
        "dynamodb:BatchWriteItem",
        "dynamodb:DeleteItem",
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:Query",
        "dynamodb:UpdateItem"
      ],
      "Resource": ["arn:aws:dynamodb:eu-west-1:1234567891234:table/*"],
      "Condition": {
        "ForAllValues:StringEquals": {
          "dynamodb:LeadingKeys": ["${aws:username}"]}
    }
  }]
}

```

I have a user named `Bahaika` who belongs to the `Users` group.

In DynamoDB I created two items :

```
-------------------------
|  Dog ID  |   User Id  |
-------------------------
|   Dog1   |  Bahaika   |
-------------------------
|   Dog2   | NotBahaika |
-------------------------

```

I'd like to be able to only get Dog1, but not Dog2 when I'm logged with the `Access Key ID` and `Secret Access Key` of Bahaika.

I also want to automatically add the `User ID` attributes when an item is added to the table.
And, finally, I want to be able to list all the items of the tables where `User ID` is equals to the logged one.

**How can I manage to do that ?**

I already read [Fine-Grained Access Control for DynamoDB](http://docs.aws.amazon.com/amazondynamodb/latest/developerguide/FGAC_DDB.html)
but I think I've missed something.