[scarface_74]

You can do scan operations and if they use PartiQL it hides whether you are using indexes.

I usually have an explicit DENY for dynamodb:Scan for the IAM role used to access the DDB table