Which solution will meet these requirements MOST cost-effectively?
Use a proxy tier between the application and DynamoDB to regulate access to specific tables, items, and attributes.
Use IAM policies with a combination of IAM conditions and actions to implement fine-grained access control.
Use DynamoDB resource policies to regulate access to specific tables, items, and attributes.
Configure an AWS Lambda function to extract only allowed attributes from tables based on user profiles.
Explanations:
Using a proxy tier adds unnecessary complexity and cost. It would introduce an additional layer to manage, making it less cost-effective than other options.
IAM policies with fine-grained access control provide precise control over which attributes can be accessed. This is the most cost-effective and scalable solution.
DynamoDB resource policies are focused on controlling access to tables and resources at a high level, not individual attributes. This does not meet the requirements.
Using AWS Lambda adds complexity and cost by introducing a processing layer for filtering attributes. IAM policies are simpler and more efficient for this use case.
As far as I can tell, the answer is:
Use IAM policies with a combination of IAM conditions and actions to implement fine-grained access control.