A Lambda function needs to read an item from a DynamoDB table, modify some attributes, and create the item if it does not exist. The function has the primary key. Which IAM permissions should be granted to the Lambda function to allow these operations?

The correct permissions are dynamodb:UpdateItem, dynamodb:GetItem, and dynamodb:PutItem. dynamodb:GetItem is needed to read the item. dynamodb:UpdateItem allows modifying existing attributes and creating the item if it doesn't exist using the UpdateItem API with UpdateExpression and ConditionExpression (e.g., attributenotexists(id)). dynamodb:PutItem is needed if the Lambda function intends to unconditionally create or replace an item. Incorrect options: dynamodb:DeleteItem is not required as the function only reads, modifies, or creates. dynamodb:DescribeTable is for retrieving table metadata, not for data manipulation. dynamodb:GetRecords is used for DynamoDB Streams, not for direct item access. dynamodb:UpdateTable is for modifying table settings (e.g., provisioned throughput), not for item-level operations.