DynamoDB Streams now support ABAC, allowing stream access restrictions based on tags associated with individual streams. Customers can attach up to 50 tags per stream and create IAM policies that permit or deny actions according to these tags, facilitating management of multiple applications and environments without proliferating static policies.
This update supports implementing per-environment and per-team isolation by using tags like 'environment:production'. Tags on streams are managed independently from parent tables, offering flexible access segregation. ABAC for DynamoDB Streams is available in all commercial AWS Regions and GovCloud without additional charges.
Source & further reading
Amazon DynamoDB Streams now supports attribute-based access control ↗Source published 2026-08-19. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.