[bdavisx]

That doesn't make sense, you have to specify the index when you're using Dynamo.

[scarface_74]

You can do scan operations and if they use PartiQL it hides whether you are using indexes.

I usually have an explicit DENY for dynamodb:Scan for the IAM role used to access the DDB table