What is the MOST secure way to meet this new requirement?
Provision the DynamoDB table inside the same VPC that contains the Lambda functions
Create a gateway VPC endpoint for DynamoDB to provide access to the table
Use a network ACL to only allow access to the DynamoDB table from the VPC
Use a security group to only allow access to the DynamoDB table from the VPC
Explanations:
DynamoDB is a managed service and cannot be provisioned inside a VPC.
A gateway VPC endpoint allows secure, private communication between the Lambda functions in the VPC and DynamoDB, without using public internet access.
Network ACLs control traffic at the subnet level, but they cannot restrict access to specific AWS services like DynamoDB.
Security groups are stateful and work at the instance level, but DynamoDB does not support security groups for direct access control.
It appears that the answer is:
Create a gateway VPC endpoint for DynamoDB to provide access to the table