diff --git a/src/app.test.js b/src/app.test.js
index e2524a8..f6f6c3c 100644
--- a/src/app.test.js
+++ b/src/app.test.js
@@ -12,7 +12,7 @@ process.env.DYNAMODB_TABLE = 'test-table';
 
 // Mock the ddb client.
 ddbMock.on(GetCommand, {
-  Key: { SiteAndGroupKey: 'PROTECTED_SITES' },
+  Key: { PK: 'PROTECTED_SITES' },
 }).resolves({
   Item: {
     ProtectedSites: JSON.stringify([
@@ -22,7 +22,7 @@ ddbMock.on(GetCommand, {
     ]),
   },
 }).on(GetCommand, {
-  Key: { SiteAndGroupKey: 'example.host.bu.edu/protected#somegroup' },
+  Key: { PK: 'example.host.bu.edu/protected#somegroup' },
 }).resolves({
   Item: {
     rules: JSON.stringify({
diff --git a/src/authorizeRequest/authorizeRequest.js b/src/authorizeRequest/authorizeRequest.js
index 9ec9c6f..3627c98 100644
--- a/src/authorizeRequest/authorizeRequest.js
+++ b/src/authorizeRequest/authorizeRequest.js
@@ -69,7 +69,7 @@ async function authorizeRequest(userRequest, siteRule) {
   // to avoid INFO Failed to find the group in DynamoDB for group:  entire-bu-community
   const { Item } = await dynamoDb.get({
     TableName: tableName,
-    Key: { SiteAndGroupKey: siteAndGroupKey },
+    Key: { PK: siteAndGroupKey },
   });
 
   if (Item == null) {
diff --git a/src/authorizeRequest/authorizeRequest.test.js b/src/authorizeRequest/authorizeRequest.test.js
index 850d3dd..c6e4e15 100644
--- a/src/authorizeRequest/authorizeRequest.test.js
+++ b/src/authorizeRequest/authorizeRequest.test.js
@@ -10,7 +10,7 @@ process.env.DYNAMODB_TABLE = 'test-table';
 
 // Mock the ddb client.
 ddbMock.on(GetCommand, {
-  Key: { SiteAndGroupKey: 'example.host.bu.edu/somesite#somegroup' },
+  Key: { PK: 'example.host.bu.edu/somesite#somegroup' },
 }).resolves({
   Item: {
     rules: JSON.stringify({
@@ -22,7 +22,7 @@ ddbMock.on(GetCommand, {
     }),
   },
 }).on(GetCommand, {
-  Key: { SiteAndGroupKey: 'example.host.bu.edu/somesite#othergroup' },
+  Key: { PK: 'example.host.bu.edu/somesite#othergroup' },
 }).resolves({
   Item: {
     rules: JSON.stringify({
@@ -32,7 +32,7 @@ ddbMock.on(GetCommand, {
     }),
   },
 }).on(GetCommand, {
-  Key: { SiteAndGroupKey: 'example.host.bu.edu/#somegroup' },
+  Key: { PK: 'example.host.bu.edu/#somegroup' },
 }).resolves({
   Item: {
     rules: JSON.stringify({
diff --git a/src/authorizeRequest/getProtectedSites.js b/src/authorizeRequest/getProtectedSites.js
index cd9484b..7815603 100644
--- a/src/authorizeRequest/getProtectedSites.js
+++ b/src/authorizeRequest/getProtectedSites.js
@@ -17,7 +17,7 @@ async function getProtectedSites() {
 
   const { Item } = await dynamoDb.get({
     TableName: tableName,
-    Key: { SiteAndGroupKey: 'PROTECTED_SITES' },
+    Key: { PK: 'PROTECTED_SITES' },
   });
 
   const { ProtectedSites } = Item;
diff --git a/src/getOrCreateObject/resizeAndSave/lookupCustomCrop.js b/src/getOrCreateObject/resizeAndSave/lookupCustomCrop.js
index 0e57a00..2c3d380 100644
--- a/src/getOrCreateObject/resizeAndSave/lookupCustomCrop.js
+++ b/src/getOrCreateObject/resizeAndSave/lookupCustomCrop.js
@@ -28,7 +28,7 @@ async function lookupCustomCrop(url, domain, sizeMatch) {
   const params = {
     TableName: tableName,
     Key: {
-      SiteAndGroupKey: `SIZES#${domain}${siteName}`,
+      PK: `SIZES#${domain}${siteName}`,
     },
   };
 
diff --git a/template.yaml b/template.yaml
index 2a0f939..febc38c 100644
--- a/template.yaml
+++ b/template.yaml
@@ -147,12 +147,12 @@ Resources:
       Timeout: 30
       Environment:
         Variables:
-          DYNAMODB_TABLE: !Ref AccessControlDynamoDB
+          DYNAMODB_TABLE: !Ref TempAccessControlDynamoDB
           ORIGINAL_BUCKET: !Ref S3Bucket
       # The function needs permission to call back to the S3 Object Lambda Access Point with the WriteGetObjectResponse.
       Policies:
         - DynamoDBReadPolicy:
-            TableName: !Ref AccessControlDynamoDB
+            TableName: !Ref TempAccessControlDynamoDB
         - S3CrudPolicy:
             BucketName: !Ref S3Bucket
         - Statement:
@@ -169,6 +169,13 @@ Resources:
         Type: String
       TableName: !Sub ${AWS::StackName}-AccessControl
 
+  TempAccessControlDynamoDB:
+    Type: AWS::Serverless::SimpleTable
+    Properties:
+      PrimaryKey:
+        Name: PK
+        Type: String
+      TableName: !Sub ${AWS::StackName}-TempAccessControl
 
 Outputs:
   S3BucketName: