amazon web services - AWS IAM -- Using conditionals -

i new iam in aws. and, desire restrict query various users table entries primary key matches cognito id. achieve this, created policy:

{ "version": "2012-10-17", "statement": [     {         "sid": "allowaccesstoonlyitemsmatchinguserid",         "effect": "allow",         "action": [             "dynamodb:getitem",             "dynamodb:batchgetitem",             "dynamodb:query",             "dynamodb:putitem",             "dynamodb:updateitem",             "dynamodb:deleteitem",             "dynamodb:batchwriteitem"         ],         "resource": [             "arn:aws:dynamodb:us-east-1:xxxxxxxxxxx:table/user"         ],         "condition": {             "forallvalues:stringequals": {                 "dynamodb:leadingkeys": [                     "${cognito-identity.amazonaws.com:sub}"                 ]             }         }     } ] 

}

but, when querying table using postman shown below:

i getting following error:

"__type": "com.amazon.coral.service#accessdeniedexception",   "message": "user: arn:aws:sts::xxxxxxxxxxxxx:assumed-role/achintest/backplaneassumerolesession not authorized perform: dynamodb:query on resource: arn:aws:dynamodb:us-east-1:xxxxxxxxxxxxx:table/user" 

can please let me know mistake doing?

---

======== update ========

i tried using policy sim, , unable understand why query without leadingkey shown in pic below allowed.

and when provide leading key, says denied. see below pic:

it might depend on request you're issuing. iam policy using forallvalues takes every key of request consideration. policy may return false if key in request not match condition value in result.

try using foranyvalue , might trick.

see here more info.