DynamoDB

Overview

The DynamoDB connector reads the stream attached to each table you choose, so workflows react to item changes without scanning. Each record arrives as a typed event with the old and new images, and every event shows up in the trace of the run it started.

Teams use it to send a SendGrid receipt when an order item is written, to archive expired sessions to Amazon S3 and to sync subscription state from Stripe into a single table.

Supported features

• Provisioned and on-demand tables, in Standard or Standard-IA class

• Streams with NEW_AND_OLD_IMAGES, NEW_IMAGE or KEYS_ONLY

• Global tables, read from the replica in the region you choose

How streams work

Tessel assumes an IAM role in your account and reads every shard of the stream with GetShardIterator and GetRecords. It checkpoints each shard after delivery and follows shard splits in order, so changes to the same key always arrive in sequence.

{
  "Effect": "Allow",
  "Action": ["dynamodb:DescribeStream", "dynamodb:GetShardIterator",
             "dynamodb:GetRecords", "dynamodb:ListStreams"],
  "Resource": "arn:aws:dynamodb:eu-west-1:123456789012:table/orders/stream/*"
}

{
  "Effect": "Allow",
  "Action": ["dynamodb:DescribeStream", "dynamodb:GetShardIterator",
             "dynamodb:GetRecords", "dynamodb:ListStreams"],
  "Resource": "arn:aws:dynamodb:eu-west-1:123456789012:table/orders/stream/*"
}

{
  "Effect": "Allow",
  "Action": ["dynamodb:DescribeStream", "dynamodb:GetShardIterator",
             "dynamodb:GetRecords", "dynamodb:ListStreams"],
  "Resource": "arn:aws:dynamodb:eu-west-1:123456789012:table/orders/stream/*"
}

Stream retention

DynamoDB keeps stream records for 24 hours. If Tessel is paused for longer, it backfills with a parallel scan and marks the gap in the trace. Removals made by TTL carry the DynamoDB service as the principal, so Tessel types them as a separate trigger.

Permissions needed

Tessel signs in through a cross-account IAM role that trusts Tessel's account and checks an external ID. No access keys are stored. Write permissions are only required if a workflow puts or updates items.

• dynamodb:DescribeStream, dynamodb:GetShardIterator and dynamodb:GetRecords on the stream

• dynamodb:GetItem and dynamodb:Query for read actions

• dynamodb:PutItem and dynamodb:UpdateItem only on tables you write to