title: How to use DynamoDB fine grained access control with Cognito User Pools?
body: <p>I'm having trouble understanding how to use fine-grained access control on DynamoDB when logged in using Cognito User Pools. I've followed the docs and googled around, but for some reason I can't seem to get it working.</p>
  
  <p>My AWS setup is listed below. If I remove the condition in the role policy, I can get and put items no problem, so it seems likely that the condition is the problem. But I can't figure out how or where to debug policies that depend on authenticated identities - what variables are available, what are their values, etc etc.</p>
  
  <p>Any help would be greatly appreciated!</p>
  
  <p><strong>DynamoDB table</strong></p>
  
  <ul>
  <li>Table name: documents</li>
  <li>Primary partition key: userID (String)</li>
  <li>Primary sort key: docID (String)</li>
  </ul>
  
  <p><strong>DynamoDB example row</strong></p>
  
  <pre><code>{
    "attributes": {},
    "docID": "0f332745-f749-4b1a-b26d-4593959e9847",
    "lastModifiedNumeric": 1470175027561,
    "lastModifiedText": "Wed Aug 03 2016 07:57:07 GMT+1000 (AEST)",
    "type": "documents",
    "userID": "4fbf0c06-03a9-4cbe-b45c-ca4cd0f5f3cb"
  }
  </code></pre>
  
  <p><strong>Cognito User Pool User</strong></p>
  
  <ul>
  <li>User Status: Enabled / Confirmed</li>
  <li>MFA Status: Disabled</li>
  <li>sub: 4fbf0c06-03a9-4cbe-b45c-ca4cd0f5f3cb</li>
  <li>email_verified: true</li>
  </ul>
  
  <p><strong>Role policy for "RoleName"</strong></p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "dynamodb:GetItem",
                  "dynamodb:PutItem"
              ],
              "Resource": [
                  "arn:aws:dynamodb:ap-southeast-2:NUMBER:table/documents"
              ],
              "Condition": {
                  "ForAllValues:StringEquals": {
                      "dynamodb:LeadingKeys": [
                          "${cognito-identity.amazonaws.com:sub}"
                      ]
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p><strong>Login information returned from cognitoUser.getUserAttributes()</strong></p>
  
  <pre><code>attribute sub has value 4fbf0c06-03a9-4cbe-b45c-ca4cd0f5f3cb
  attribute email_verified has value true
  attribute email has value ****@****com
  </code></pre>
  
  <p><strong>Error message</strong></p>
  
  <pre><code>Code: "AccessDeniedException"
  Message: User: arn:aws:sts::NUMBER:assumed-role/ROLE_NAME/CognitoIdentityCredentials is not authorized to perform: dynamodb:GetItem on resource: arn:aws:dynamodb:ap-southeast-2:NUMBER:table/documents
  </code></pre>