When I create a DynamoDB table, I can choose to encrypt the table use a customer managed Key (CMK). My question is when creating an IAM role/policy to allow say, read/write to the table, like dynamodb:GetItem, do I also need to add permission to access the key itself?
I did not seem see this in the AWS DynamoDB doc.
Yes you do, you can either add the permissions to the role, or to the key policy.