IAM policy to allow access to DynamoDB console for specific tables

Question

Is it possible to create an AWS IAM policy that provides access to the DynamoDB console only for specific tables? I have tried:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt0000000001",
            "Action": [
                "dynamodb:DescribeTable",
                "dynamodb:ListTables",
                <other actions>
            ], 
            "Effect": "Allow",
            "Resource": [
                "arn:aws:dynamodb:<region>:<account>:table/FooTable",
                "arn:aws:dynamodb:<region>:<account>:table/BarTable"
            ]
        }
    ]
}

but for a user with this policy attached, the DynamoDB tables list says Not Authorized (as it does when no policy is attached).

Setting "Resource" to "*" and adding a new statement like below lets the user perform <other actions> on FooTable and BarTable, but they can also see all other tables in the tables list.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt0000000001",
            "Action": [
                <other actions>
            ], 
            "Effect": "Allow",
            "Resource": [
                "arn:aws:dynamodb:<region>:<account>:table/FooTable",
                "arn:aws:dynamodb:<region>:<account>:table/BarTable"
            ]
        },
        {
            "Sid": "Stmt0000000002",
            "Action": [
                "dynamodb:DescribeTable",
                "dynamodb:ListTables"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

Answer 1

Sorry for the bad news, but the AWS Management Console requires both DescribeTable and ListTables permissions against the whole of DynamoDB in order to operate correctly.

However, there is a small workaround... You can give Console users a URL that takes them directly to the table, and operates fine for viewing and adding items, etc.

Just copy the URL from a user that has correct permissions, eg:

https://REGION.console.aws.amazon.com/dynamodb/home?region=REGION#explore:name=TABLE-NAME