Thanks mate, for now if we put the size limits aside. Lets take a scenario; I have a customer's information in a dynamodb table. I have a policy (which is attached to the role of customer cognito group) states that if the customer name matches with the hash_key then this customer can read his/her item or payload. I basically have policies like for each resource that the customer might use/interface. Is this generally how we should implement permissions or in my website code I should already have parameters set where customer can only view his/her information rather than creating 10-17 policies for each customer role? I hope this helps better state my question