To list domains, sdb:ListDomains permission is required on * resource. So if you give * permission on a particular domain, listing of domains could not take place. Giving sdb:ListDomains permission on * resource, will list all the domains. But user should only access those domains for which he has access permission. For this, your policy looks like :- { "Version": "2008-10-17", "Statement": [ { "Sid": "412A", "Effect": "Allow", "Action": "*", "Resource": {"Resource": "arn:aws:sdb:123456321:domain/User_domain" } }, { "Sid": "412B", "Effect": "Allow", "Action": "sdb:ListDomains", "Resource": "*" } ] }