AWS amazondynamodb high security documentation change

Service: amazondynamodb · 2025-10-13 · Security-related high

File: amazondynamodb/latest/developerguide/DAX.create-cluster.DAX_and_IPV6.md

Summary

Added guidance for IPv6 DAX clusters requiring IAM policy exceptions when blocking IPv4 access

Security assessment

The change addresses a potential misconfiguration where DAX clusters could lose access to DynamoDB tables if IPv4 is blocked without IAM role exceptions. This directly relates to security posture by preventing accidental denial of service and ensuring proper access control.

Diff

diff --git a/amazondynamodb/latest/developerguide/DAX.create-cluster.DAX_and_IPV6.md b/amazondynamodb/latest/developerguide/DAX.create-cluster.DAX_and_IPV6.md
index d18c73ddc..5ed86f39c 100644
--- a//amazondynamodb/latest/developerguide/DAX.create-cluster.DAX_and_IPV6.md
+++ b//amazondynamodb/latest/developerguide/DAX.create-cluster.DAX_and_IPV6.md
@@ -26 +26 @@ With IPv6 support, you can do the following:
-  * **Network Configuration Options:**
+  * **Network configuration options:**
@@ -32 +32 @@ With IPv6 support, you can do the following:
-  * **Subnet Group Management:**
+  * **Subnet group management:**
@@ -42 +42 @@ With IPv6 support, you can do the following:
-  * **Client Configuration:**
+  * **Client configuration:**
@@ -75,0 +76,28 @@ Before implementing IPv6 in your DAX clusters, you must consider the following:
+###### Important
+
+When you use resource-based IAM policies to restrict IP addresses for DynamoDB tables in IPv6-only environments with DAX, you must create an exception for your DAX cluster's IAM role if you block the IPv4 address space (`0.0.0.0/0`). Add an `ArnNotEquals` condition to your policy that specifically allows access for the DAX cluster's IAM role while maintaining IP-based restrictions for other access paths. Without this exception, DAX cannot access your DynamoDB table.
+
+For example:
+    
+    
+    {
+      "Version": "2012-10-17";
+      "Statement": [
+        {
+          "Sid": "Statement1",
+          "Effect": "Deny",
+          "Principal": "*",
+          "Action": "dynamodb:PutItem",
+          "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MusicCollection",
+          "Condition": {
+            "ArnNotEquals": {
+              "aws:PrincipalArn": "arn:aws:iam::123456789012:role/DAXServiceRoleForDynamoDBAccess"
+            },
+            "IpAddress": {
+              "aws:SourceIp": "0.0.0.0/0"
+            }
+          }
+        }
+      ]
+    }
+