Isn't it supposed to be read only for security - that's at least a big benefit in my book. Ideally without dynamodb query permission either. etc