Amazon DynamoDB

Connect to Amazon DynamoDB with PartiQL queries, GSI/LSI browsing, and DynamoDB Local support

Opening a table runs a Scan. A filter becomes a Query only when it pins the partition key to a single value with =; every other filter is applied to the items after they come back, so it narrows what you see and not what the table read.

The driver is not in the app. Picking in the Choose a Database sheet offers the download before the form opens, and opening a saved connection installs it without asking. Settings > Plugins > Browse > installs it up front. See Plugins.

Quick setup

Click Create Connection…, select DynamoDB, choose an Auth Method, enter credentials and region, then click Save & Connect.

The DynamoDB connection form with an auth method picked

Connection settings

The form asks for no host, no port and no database, and offers no SSL/TLS pane. Every request is an HTTPS call to the AWS endpoint signed with SigV4, and one connection sees one region’s tables.

Field	Description
AWS Region	Region the tables live in. Defaults to us-east-1
Custom Endpoint	Overrides the endpoint URL. Leave it empty unless you run DynamoDB Local

Authentication

Auth Method	Fields	Credentials come from
Access Key + Secret Key	Access Key ID, Secret Access Key, and Session Token for STS	What you type
AWS Profile	Profile Name	That profile in ~/.aws/config and ~/.aws/credentials, read the way the AWS CLI reads it
AWS SSO	Profile Name	The IAM Identity Center token cached in ~/.aws/sso/cache. Run aws sso login --profile <name> first

Pick AWS Profile if the AWS CLI already works on this Mac. Static keys, credential_process helpers and role_arn chains all resolve; the rules are on AWS IAM Authentication.

DynamoDB Local

docker run -p 8000:8000 amazon/dynamodb-local

Set Auth Method to Access Key + Secret Key, put any non-empty string in Access Key ID and Secret Access Key, and set Custom Endpoint to http://localhost:8000.

Columns over schemaless items

A table declares only its key attributes, so the grid builds columns from the items it fetched: the union of their attribute names, partition key first, sort key next, the rest alphabetically. An attribute none of those items carries gets no column. Each column’s type is a majority vote over the same items; the Structure tab votes on a sample of up to 100.

Attribute type	In the cell
S, N, BOOL, NULL	The value
B	Base64
L, M	DynamoDB-typed JSON, [{"S":"a"}] and {"k":{"S":"a"}}
SS, NS, BS	A plain JSON array

An edit is parsed back through the same shape, so keep the typed envelopes when you change a list or a map.

In Table Structure, Indexes lists the primary key with every GSI and LSI, and DDL prints the key schema, billing mode, capacity, item count, table size and each index’s projection.

PartiQL

The editor runs PartiQL. Table names take double quotes, string values single quotes: SELECT * FROM "Users" WHERE userId = 'user123'. Amazon’s PartiQL reference has the grammar.

Grid edits become PartiQL as well, one INSERT, UPDATE or DELETE per row. A key attribute is never part of a SET: to change a key, delete the item and insert it again.

IAM permissions

The driver calls ListTables, DescribeTable, Scan, Query and ExecuteStatement, and nothing else. That is this policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:ListTables",
        "dynamodb:DescribeTable",
        "dynamodb:Scan",
        "dynamodb:Query",
        "dynamodb:PartiQLSelect",
        "dynamodb:PartiQLInsert",
        "dynamodb:PartiQLUpdate",
        "dynamodb:PartiQLDelete"
      ],
      "Resource": "*"
    }
  ]
}

For read-only access, drop PartiQLInsert, PartiQLUpdate and PartiQLDelete.

Limitations

• Consumed capacity is never reported. Nothing in the app shows what a browse cost; read it in CloudWatch.
• Paging is cursor-based, so page 40 re-scans everything before it.
• A list or map cell is cut at 10,000 characters and ends in .... Saving an edit to a cut cell stores the fragment; change long nested values with PartiQL instead.
• Table structure is fixed at creation: no structure editing, no transactions, no import.
• Item counts come from DynamoDB and refresh roughly every six hours, so they lag.
• DAX endpoints are not supported. Leave Custom Endpoint empty or point it at a standard endpoint.

Troubleshooting

Authentication failed: …

The credentials were rejected: an unrecognized key, a bad signature, or a policy that denies the call. Check the key and secret, the profile name, or the SSO session with aws sso login --profile <name>. An aged-out STS session token needs replacing.

DynamoDB error: [ResourceNotFoundException] …

The table is not in this region. Tables are regional; set AWS Region to the one the table was created in.

DynamoDB error: [ProvisionedThroughputExceededException] …

The table’s provisioned read capacity is used up. Retry, move the table to on-demand billing, or filter on the partition key so the browse runs as a Query.

Related

• AWS IAM Authentication
• Import & Export