One of the major challenges of working with AWS is working with IAM. Everything is built around IAM and having permission to do whatever technical action. As an engineer the experience of knowing that I need a set of permissions for my role to utilize to do an action like reading from DynamoDB has made my job much easier. For example in a typical cloudformation policy something like

- Effect: Allow
  Action:
    - 'dynamodb:GetItem'
  Resource: 'arn:aws:dynamodb:us-west-2:${Account}:table/test-table'

would seem to be sufficient to read objects from that table, but in reality you would need ‘dynamodb:DescribeTable’ as well. If I wanted to read from an index I would need to append to the resource to be something more like

- Effect: Allow
  Action:
    - 'dynamodb:GetItem'
    - 'dynamodb:DescribeTable'
    - 'dynamodb:Query'
  Resource: 
    - 'arn:aws:dynamodb:us-west-2:${Account}:table/test-table'
    - 'arn:aws:dynamodb:us-west-2:${Account}:table/test-table/index/*'