DynamoDB

A DynamoDB table with encryption, point-in-time recovery and deletion protection on. On-demand billing, with attribute definitions derived for you.

Database · anvil:aws:DynamoDB

Arguments

Names below are TypeScript (camelCase). In Python use snake_case (e.g. dataClassification → data_classification); in Go use PascalCase on the Args struct (e.g. DataClassification).

hashKey required
object (DynamoDBKeyAttribute)

Primary hash (partition) key — { name, type } where type is S, N, or B.

rangeKey
object (DynamoDBKeyAttribute)

Primary range (sort) key. Optional.

globalSecondaryIndexes
array

Global Secondary Indexes. All GSI key types must be explicitly declared — Anvil derives attributeDefinitions automatically from all declared keys.

stream
object (DynamoDBStream)

DynamoDB Streams configuration. Opt-in. Enables change data capture on the table.

ttlAttribute
string

Name of the attribute used for TTL (time-to-live). Items with this attribute set to a past Unix timestamp are automatically deleted by DynamoDB.

kmsKeyArn
string

Tier 2 opt-in. ARN of a KMS CMK for encryption at rest. If omitted, AWS-owned KMS is used (always on, zero cost). Use this for compliance workloads requiring key rotation control or the ability to revoke access by disabling the key.

globalSecondaryIndexes[] 5 fields

A Global Secondary Index. All key attributes must use the explicit { name, type } shape — Anvil merges these into the table attributeDefinitions automatically.

hashKey required
object (DynamoDBKeyAttribute)

GSI hash key. Must include name and type explicitly.

name required
string

GSI name.

nonKeyAttributes
array<string>

Non-key attributes to project. Only valid when projectionType is INCLUDE.

projectionType
string

Projection type. Defaults to ALL.

  • ALL— All attributes are projected. Default.
  • KEYS_ONLY— Only the table and GSI key attributes are projected.
  • INCLUDE— Only the specified nonKeyAttributes are projected in addition to keys.
rangeKey
object (DynamoDBKeyAttribute)

GSI range key. Optional. Must include name and type explicitly.

globalSecondaryIndexes[].hashKey 2 fields

A DynamoDB key attribute with an explicit name and type. All keys — table and GSI — must use this shape. Anvil derives attributeDefinitions automatically.

name required
string

Attribute name.

type required
string

Attribute type. S = String, N = Number, B = Binary.

  • S— String
  • N— Number
  • B— Binary
globalSecondaryIndexes[].rangeKey 2 fields

A DynamoDB key attribute with an explicit name and type. All keys — table and GSI — must use this shape. Anvil derives attributeDefinitions automatically.

name required
string

Attribute name.

type required
string

Attribute type. S = String, N = Number, B = Binary.

  • S— String
  • N— Number
  • B— Binary
hashKey 2 fields

A DynamoDB key attribute with an explicit name and type. All keys — table and GSI — must use this shape. Anvil derives attributeDefinitions automatically.

name required
string

Attribute name.

type required
string

Attribute type. S = String, N = Number, B = Binary.

  • S— String
  • N— Number
  • B— Binary
rangeKey 2 fields

A DynamoDB key attribute with an explicit name and type. All keys — table and GSI — must use this shape. Anvil derives attributeDefinitions automatically.

name required
string

Attribute name.

type required
string

Attribute type. S = String, N = Number, B = Binary.

  • S— String
  • N— Number
  • B— Binary
stream 4 fields

DynamoDB Streams configuration. Opt-in.

consumer required
object (DynamoDBStreamConsumer)

The consumer of the stream. Discriminated union — exactly one of lambda or eventBridge.

viewType required
string

The stream view type. Controls what data is written to the stream on item changes.

  • NEW_IMAGE— Only the new item image is written to the stream.
  • OLD_IMAGE— Only the old item image is written to the stream.
  • NEW_AND_OLD_IMAGES— Both old and new item images are written to the stream.
  • KEYS_ONLY— Only the key attributes are written to the stream.
batchSize
integer

Number of stream records to send to the consumer per batch. Defaults to 100.

startingPosition
string

Where to start reading the stream. Defaults to TRIM_HORIZON (AWS default — replays all existing records). Set to LATEST to only receive new events from the point of consumer creation.

  • TRIM_HORIZON— Start reading from the oldest available record in the stream. Replays all existing records up to 24hr retention window. AWS default.
  • LATEST— Start reading from the most recent record. Only processes new events from the point of consumer creation.
stream.consumer 2 fields

Discriminated union for the stream consumer. Exactly one of lambda or eventBridge must be set.

eventBridge
object (DynamoDBStreamEventBridgeConsumer)

Wire an EventBridge bus as the stream consumer via an EventBridge Pipe. Use this for fanout — the bus routes to multiple targets via rules. Bypasses the 2-consumer-per-shard limit of direct Lambda ESM.

lambda
object (DynamoDBStreamLambdaConsumer)

Wire a Lambda function as the stream consumer via AWS-managed Event Source Mapping.

stream.consumer.eventBridge 2 fields

EventBridge Pipe consumer. Anvil creates the Pipe, a scoped IAM role for the Pipe, and wires the stream to the target bus. Use this for fanout to multiple targets via EventBridge rules.

busArn required
string

ARN of the target EventBridge event bus.

name required
string

Name of the target EventBridge event bus (anvil.aws.EventBus).

stream.consumer.lambda 2 fields

Lambda stream consumer. Anvil creates the ESM, lambda:InvokeFunction permission, and attaches stream read permissions to the Lambda role. Does not grant table read/write access — call grantRead/Write separately if needed.

arn required
string

ARN of the Lambda function.

lambdaRoleArn required
string

ARN of the Lambda execution role. Anvil attaches an inline policy granting stream read permissions (GetRecords, GetShardIterator, DescribeStream, ListStreams).

This component also accepts a hatch argument to override the underlying resource configuration. See Overrides & Escape Hatch.

Attributes

Outputs available once the resource is deployed.

tableName
string

The physical DynamoDB table name. Scoped as {name}-{stage}.

tableArn
string

The ARN of the DynamoDB table.

streamArn
string

The ARN of the DynamoDB stream. Only present when stream is enabled.