title: Permission model with users and user groups in DynamoDB
body: <p>I have a "relational" model, with the following types:</p>
  
  <ul>
  <li>Users</li>
  <li>User Groups</li>
  <li>Items</li>
  </ul>
  
  <p>Users can be part of multiple groups and groups can have multiple users.</p>
  
  <p>Items have users and groups that are allowed to read or perform operations on them.</p>
  
  <p>The most common query will be, that a user queries an item by its id. For this, it must be checked that the user has the needed permissions to query the item. In other words it or one of its groups must have permissions on the item.</p>
  
  <p><strong>What I came up with so far</strong></p>
  
  <p>A solution would be, that the items have the following properties:</p>
  
  <ul>
  <li><p>Users</p>
  
  <ul>
  <li>Primary Key: user-id</li>
  <li>No sort key</li>
  <li>Properties: list of groups</li>
  </ul></li>
  <li><p>Items:</p>
  
  <ul>
  <li>Primary Key: item-id</li>
  <li>Sort key:
  
  <ul>
  <li><code>'data'</code>: Data for this item</li>
  <li><code>&lt;user/group-id&gt;</code>: Permission for this user or group</li>
  </ul></li>
  </ul></li>
  </ul>
  
  <p>So to check permissions, one would have to</p>
  
  <ul>
  <li>Get the groups of a user</li>
  <li>Get the permissions by querying the item-id with the user id and all of the group ids as sort keys (using BatchGetItems).</li>
  <li>Check that the user or any of its groups have the needed permissions.</li>
  </ul>
  
  <p><strong>The Question</strong></p>
  
  <p>I feel like this can result in huge queries, especially when the number of groups is high.</p>
  
  <p>Is there a way to realize this permission model (or a similar permission model) without so expensive permission checks?</p>