DynamoDB

A DynamoDB table with encryption, point-in-time recovery and deletion protection on. On-demand billing, with attribute definitions derived for you.

Database · anvil:aws:DynamoDB

Minimal

The smallest config that deploys.

import { App } from '@anvil-cloud/sdk';
import * as anvil from '@anvil-cloud/sdk';

export default new App({
  run(ctx) {
    const orders = new anvil.aws.DynamoDB('orders', {
      hashKey: { name: 'pk', type: 'S' },
    });
  },
});
import anvil_cloud as anvil

def infra(ctx: anvil.Context):
    orders = anvil.aws.DynamoDB("orders",
        hash_key={"name": "pk", "type": "S"},
    )

anvil.App(run=infra)
package main

import (
    "github.com/anvil-cloud/anvil/sdk/go/anvil"
    anvilaws "github.com/anvil-cloud/anvil/sdk/go/anvil/aws"
    "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
    anvil.Run(anvil.AppConfig{
        Run: func(ctx *anvil.Context) error {
            _, err := anvilaws.NewDynamoDB(ctx.PulumiCtx(), "orders", &anvilaws.DynamoDBArgs{
                HashKey: &anvilaws.DynamoDBKeyAttributeArgs{Name: pulumi.String("pk"), Type: anvilaws.DynamoDBAttributeTypeS},
            })
            if err != nil {
                return err
            }
            return nil
        },
    })
}

Granting access

Grant compute access with grantRead, grantWrite, grantReadWrite or grantDelete. Grants cover the table itself; pass { indexes: ['byCustomer'] } to let it query those secondary indexes too.

orders.grantReadWrite(api);
orders.grantRead(reports);
orders.grant_read_write(api)
orders.grant_read(reports)
// Go has no grant methods yet: give the Lambda the same actions with permissions.
api, err := anvilaws.NewLambda(ctx.PulumiCtx(), "api", &anvilaws.LambdaArgs{
    Runtime: anvilaws.LambdaRuntime_Nodejs24_x,
    Handler: pulumi.String("functions/api/index.handler"),
    Permissions: anvilaws.LambdaPermissionArray{
        // grantReadWrite(api)
        anvilaws.LambdaPermissionArgs{
            Actions: pulumi.ToStringArray([]string{
                "dynamodb:GetItem", "dynamodb:BatchGetItem", "dynamodb:Query", "dynamodb:Scan",
                "dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:BatchWriteItem",
            }),
            Resource: orders.TableArn,
        },
    },
})
if err != nil {
    return err
}

What Anvil creates

  • grantRead adds GetItem, BatchGetItem, Query and Scan. grantWrite adds PutItem, UpdateItem and BatchWriteItem. grantReadWrite is both, and grantDelete adds DeleteItem. No grant includes DeleteTable or any change to the table itself.
  • The actions apply to this table only, and to its indexes only when you name them in indexes.
  • Each grant is an inline policy on the compute's role, removed when you remove the grant.

Good to know

  • Encryption, point-in-time recovery and deletion protection are always on, and billing is on-demand.
  • Only key attributes are declared (hashKey, rangeKey and index keys). Anvil derives the attribute definitions, and other attributes need no schema.
  • ttlAttribute names an attribute holding a Unix timestamp in seconds. DynamoDB deletes items once it has passed, usually within a few days.
  • stream is opt-in change data capture: a Lambda or EventBridge consumer receives every change to the table.

The Full example tab has a complete programand the runtime code that uses it. Every argument and attribute is on the Reference tab.