policy.py

def generate_dynamodb_policy(tenant_id):
  return {
      "Version": "2012-10-17",
      "Statement": [{
          "Effect": "Allow",
          "Action": ["dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query"],
          "Resource": [
              f"arn:aws:dynamodb:<region>:<account-id>:table/TableName",
              f"arn:aws:dynamodb:<region>:<account-id>:table/TableName/index/*",
          ],
          "Condition": {
              "ForAllValues:StringLike": {
                  "dynamodb:LeadingKeys": [f"TENANT#{tenant_id}", f"TENANT#{tenant_id}#*"]
              }
          }
      }]
   }