DynamoDB Block Public Access toggle and resource-based policy interaction

Answer to the Core Question

When Block Public Access is enabled for a DynamoDB table, the service inserts a built‑in deny‑all rule that applies to any request that does not carry an authenticated IAM principal. If a resource‑based policy contains "Principal": "*", that policy will not allow anonymous access while the toggle is on. In other words, the toggle actively blocks requests from anonymous principals and takes precedence over the policy’s allow statement.

Precedence Order

1. Block Public Access – evaluated first. If it is enabled, any request lacking a valid IAM credential is rejected.
2. IAM identity‑based policies – evaluated next. These govern what authenticated users or roles can do.
3. Resource‑based policies – evaluated last. They can grant additional permissions to principals that the previous layers have already allowed.

Because the toggle is the earliest guardrail, it effectively masks any Principal": "*" allow that would otherwise expose the table to the public.

How to Verify the Behavior

Below is a minimal, safe workflow you can run from an environment that has no IAM role attached (e.g., a fresh EC2 instance or a local machine without configured credentials).

# Enable Block Public Access for a table named MyTable
aws dynamodb update-public-access \
  --resource-type TABLE \
  --resource-arn arn:aws:dynamodb:us-east-1:123456789012:table/MyTable \
  --block-public-access true

# Attach a permissive resource policy (allowing "*")
aws dynamodb put-item \
  --table-name MyTable \
  --item '{"PK":{"S":"Test"},"Data":{"S":"value"}}'

# Create a resource policy that allows all principals
aws dynamodb put-table-policy \
  --table-name MyTable \
  --policy-name PublicPolicy \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": "*",
        "Action": "dynamodb:*",
        "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"
      }
    ]
  }'

# Attempt a GetItem without credentials – should fail
aws dynamodb get-item \
  --table-name MyTable \
  --key '{"PK":{"S":"Test"}}'

The last command will return an AccessDeniedException. If you disable the toggle:

aws dynamodb update-public-access \
  --resource-type TABLE \
  --resource-arn arn:aws:dynamodb:us-east-1:123456789012:table/MyTable \
  --block-public-access false

and re‑run the get-item, the request succeeds, confirming the toggle’s precedence.

Scope and Limitations

• The block applies only to unauthenticated requests. If a request carries a valid IAM role, user, or service principal, the resource policy still governs access.
• Traffic that is already authenticated via a VPC endpoint or other service‑level authentication is unaffected by the toggle.
• Conditions inside the resource policy (e.g., IP or VPC endpoint constraints) do not change the toggle’s behavior; anonymous requests are still denied.

What to Check Next?

If you are seeing unexpected access for unauthenticated clients even after enabling Block Public Access, verify that:

• There is no other service (e.g., API Gateway) that proxies the request with credentials.
• The request originates from an environment that truly lacks IAM credentials (no instance profile, no AWS CLI profile).
• CloudTrail logs show the denial occurs at the service layer, not due to a policy evaluation.