There indeed is a way to directly call DynamoDB from a React frontend 100% securely, without having to use AWS credentials in frontend code. See https://blog.bitsrc.io/developing-two-tier-web-apps-with-react-and-aws-daac41abd95e