0

I've set up a new DynamoDB table, and then am fetching data from it directly through a React app using the aws-sdk.

I'm new to DynamoDB, but I've used Google's Firestore extensively in the past. One of the problems I encountered there was that data in my Firestore database was completely public, using endpoints like this:

https://firestore.googleapis.com/v1/projects/{my-project-name}/databases/(default)/documents/{collection-name}/{document-name}?pageSize=30

and I was unable to secure the database if I wanted to use some of the data in public web pages. Here is a stack overflow discussing this: https://stackoverflow.com/questions/53425585/restricting-cloud-firestore-to-a-specific-domain#:~:text=Firebase%20security%20rules%20aren't,be%20coming%20from%20some%20domain

So, my question is: does this same problem exist with DynamoDB (if I want my data to be accessed directly from my React app)?

jerfp
  • 145
  • 1
  • 9
  • Generally speaking: yes. If *your* frontend can just access the database without a user having to first log in with accounts that you manage (e.g. via an idp) then *anyone* can access the data. This is completely unrelated to dynamodb or firebase, it applies to *any* API: if you have no user-specific access control then anybody can access it. – luk2302 Jul 29 '21 at 15:44

0 Answers0