DynamoDB - Ensuring users only have access to their data. I think to some this might sound like an obvious thing, but I just want to make doubly sure. What's the best way to ensure that a user only gets access to their data. "Best" is both in terms of security and speed. (The user_id column is not used as partition or sort key, but there is an index based on user_id)

Do I include a condition that check "user_id" which will ensure that if the data requested does not belong to the user, no data is returned. Or, do I return the data regardless of "user_id" and then. do the check in code. The risk here is that if there's an issue with the code for whatever reason, data could be retuned that doesn't belong to the user since that data has been retrieved.

While speed and security is important, obviously, I'd also like to understand how people do it in general. Like what is "the standard"?

Thanks.