> ## Documentation Index
> Fetch the complete documentation index at: https://ngquct-feat-721-compare-sync.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon DynamoDB

> Connect to Amazon DynamoDB with PartiQL queries, GSI/LSI browsing, and DynamoDB Local support

TablePro connects to Amazon DynamoDB over the AWS HTTP API. Sign in with IAM credentials, an AWS profile, or SSO. Browse tables, run PartiQL queries, inspect GSI and LSI indexes, and edit items in the data grid.

## Quick Setup

Click **New Connection**, select **DynamoDB**, choose an auth method, enter your credentials and region, then click **Save & Connect**. The plugin auto-installs when you pick DynamoDB, or install it from **Settings > Plugins > Browse > DynamoDB Driver**.

## Authentication Methods

**Access Key + Secret Key**: IAM credentials. Add a session token if you are using temporary credentials from STS.

**AWS Profile**: Reads the named profile from both `~/.aws/config` and `~/.aws/credentials`, the same way the AWS CLI does. A profile can supply static keys (`aws_access_key_id`, `aws_secret_access_key`, optional `aws_session_token`) or a `credential_process` command. Profiles defined only in `~/.aws/config` (as `[profile name]`) resolve too.

**AWS SSO**: Reads the cached SSO token from `~/.aws/sso/cache/`. Run `aws sso login --profile my-sso-profile` before connecting. Tokens expire; the connection re-resolves credentials automatically and tells you to re-run `aws sso login` when the session has ended.

## Connection Settings

| Field                 | Description                                                                                |
| --------------------- | ------------------------------------------------------------------------------------------ |
| **Auth Method**       | Access Key + Secret Key, AWS Profile, or AWS SSO                                           |
| **Access Key ID**     | IAM access key, e.g. `AKIA...`. Access Key auth only                                       |
| **Secret Access Key** | The matching secret. Access Key auth only                                                  |
| **Session Token**     | Optional token for temporary STS credentials. Access Key auth only                         |
| **Profile Name**      | Profile to read from `~/.aws/config` or `~/.aws/credentials`. AWS Profile and AWS SSO only |
| **AWS Region**        | Region your tables live in. Defaults to `us-east-1`                                        |
| **Custom Endpoint**   | Overrides the DynamoDB endpoint URL. Leave it empty unless you run DynamoDB Local          |

## DynamoDB Local

Start a local instance:

```bash theme={null}
docker run -p 8000:8000 amazon/dynamodb-local
```

Set **Auth Method** to Access Key + Secret Key, put any non-empty string in **Access Key ID** and **Secret Access Key**, and set **Custom Endpoint** to `http://localhost:8000`.

## Features

**Table Browsing**: The sidebar lists every table. Open one to see its data, its structure (attribute names and types), its indexes (primary key, GSI, LSI), and its DDL (key schema, billing mode, throughput, item count, and size).

**Schemaless Discovery**: DynamoDB tables have no fixed schema, so TablePro reads the attribute names from the items it fetched and picks each column's type by majority vote. The Structure tab samples up to 100 items. Partition and sort keys come first, then the other attributes in alphabetical order.

**PartiQL Queries** ([reference](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/ql-reference.html)):

```sql theme={null}
-- Select items
SELECT * FROM "Users" WHERE userId = 'user123'

-- Insert an item
INSERT INTO "Users" VALUE {'userId': 'user456', 'name': 'Alice', 'age': 30}

-- Update an item
UPDATE "Users" SET name = 'Bob' WHERE userId = 'user123'

-- Delete an item
DELETE FROM "Users" WHERE userId = 'user123'

-- Query with conditions
SELECT * FROM "Orders"
WHERE customerId = 'cust001' AND orderDate BETWEEN '2024-01-01' AND '2024-12-31'
```

<Tip>
  Table names in PartiQL must be quoted with double quotes: `"TableName"`. String values use single quotes: `'value'`.
</Tip>

**Data Types**: S (string), N (number), B (binary), BOOL, NULL, L (JSON array), M (JSON object), SS (string set), NS (number set), BS (binary set).

**Data Editing**: Edit cells, insert rows, and delete rows. TablePro generates PartiQL: `INSERT INTO "Table" VALUE { ... }`, `UPDATE "Table" SET attr = 'val' WHERE pk = 'pkVal'`, and `DELETE FROM "Table" WHERE pk = 'pkVal'`. Key attributes cannot be changed, so delete the item and insert it again.

**Query Instead of Scan**: A filter that pins the partition key to a single value with `=` runs through the Query API instead of Scan. It returns faster and burns less read capacity.

**Capacity and Metrics**: Billing mode (`PAY_PER_REQUEST`, or `PROVISIONED` with read and write capacity units), approximate item count, table size, and GSI/LSI details.

**Export**: CSV, JSON, SQL, XLSX formats.

## IAM Permissions

The IAM user or role needs these permissions at minimum:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:ListTables",
        "dynamodb:DescribeTable",
        "dynamodb:Scan",
        "dynamodb:Query",
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:PartiQLSelect",
        "dynamodb:PartiQLInsert",
        "dynamodb:PartiQLUpdate",
        "dynamodb:PartiQLDelete"
      ],
      "Resource": "*"
    }
  ]
}
```

For read-only access, remove the write actions (`PutItem`, `UpdateItem`, `DeleteItem`, `PartiQLInsert`, `PartiQLUpdate`, `PartiQLDelete`).

## Troubleshooting

**Auth failed**: Check the access key and secret, the profile name, or the SSO session. For SSO, run `aws sso login --profile my-sso-profile`. If you pasted a temporary session token, get a fresh one from STS.

**Access denied**: Check the IAM policy on the user or role, the resource ARNs it covers, and any service control policies or permission boundaries above it.

**Region mismatch**: Tables are region-specific. Make sure **AWS Region** matches the region the table was created in.

**Throughput exceeded**: Wait and retry, switch the table to on-demand billing, or add filters so fewer items are scanned.

## Limitations

* Every request is an independent HTTPS call signed with SigV4. There are no persistent connections and no SSH tunneling.
* Table structure is fixed when the table is created. TablePro cannot edit it.
* Item counts come from DynamoDB and refresh about every 6 hours, so they lag.
* Pagination is cursor-based, so jumping to a far page re-scans from the start.
* No transactions.
* DAX endpoints are not supported. Connect to the standard DynamoDB endpoint.