AWS CloudFormation DynamoDB Patterns Skill

AWS CloudFormation DynamoDB Patterns

Provides production-ready NoSQL database infrastructure patterns using AWS CloudFormation templates with DynamoDB tables, GSIs, LSIs, auto-scaling, encryption, TTL, and streams.

Overview

Covers DynamoDB tables, primary keys, secondary indexes (GSI/LSI), capacity modes, auto-scaling, encryption, TTL, streams, and best practices for parameters, outputs, and cross-stack references.

When to Use

Creating DynamoDB tables, configuring keys and indexes, setting capacity modes, implementing auto-scaling, enabling encryption/TTL/streams, and organizing CloudFormation templates.

Instructions

Follow these steps to create DynamoDB tables with CloudFormation:

Define Table Parameters: Specify table name and billing mode
Configure Primary Key: Set partition key and optional sort key
Add Secondary Indexes: Create GSIs for alternative access patterns
Configure Encryption: Enable encryption using KMS keys
Set Up TTL: Define timestamp attribute for automatic deletion
Enable Streams: Configure stream for change data capture
Add Auto Scaling: Implement Application Auto Scaling for provisioned capacity
Create Backup: Enable point-in-time recovery
Validate Template: Run aws cloudformation validate-template before deployment
Deploy Stack: Use aws cloudformation create-stack or update-stack
Monitor Events: Check aws cloudformation describe-stack-events for failures or ROLLBACK status
Handle Rollback: On failure, review events for resource errors, fix the template, and re-deploy

Quick Reference

| Resource Type | Purpose | |---------------|---------| | AWS::DynamoDB::Table | Create DynamoDB table | | AWS::ApplicationAutoScaling::ScalableTarget | Auto scaling configuration | | AWS::ApplicationAutoScaling::ScalingPolicy | Scaling policies | | AWS::KMS::Key | KMS key for encryption | | AWS::IAM::Role | IAM roles for auto scaling | | BillingMode | PAY_PER_REQUEST or PROVISIONED | | SSESpecification | Server-side encryption |

Examples

Basic Table with On-Demand Capacity

DynamoDBTable:
  Type: AWS::DynamoDB::Table
  Properties:
    TableName: !Sub "${AWS::StackName}-table"
    BillingMode: PAY_PER_REQUEST
    AttributeDefinitions:
      - AttributeName: pk
        AttributeType: S
    KeySchema:
      - AttributeName: pk
        KeyType: HASH

Table with Global Secondary Index

DynamoDBTable:
  Type: AWS::DynamoDB::Table
  Properties:
    TableName: !Sub "${AWS::StackName}-table"
    BillingMode: PAY_PER_REQUEST
    AttributeDefinitions:
      - AttributeName: pk
        AttributeType: S
      - AttributeName: gsi-pk
        AttributeType: S
    KeySchema:
      - AttributeName: pk
        KeyType: HASH
    GlobalSecondaryIndexes:
      - IndexName: gsi-index
        KeySchema:
          - AttributeName: gsi-pk
            KeyType: HASH
        Projection:
          ProjectionType: ALL

Table with TTL

SessionTable:
  Type: AWS::DynamoDB::Table
  Properties:
    TableName: !Sub "${AWS::StackName}-sessions"
    BillingMode: PAY_PER_REQUEST
    AttributeDefinitions:
      - AttributeName: sessionId
        AttributeType: S
    KeySchema:
      - AttributeName: sessionId
        KeyType: HASH
    TimeToLiveSpecification:
      AttributeName: expiresAt
      Enabled: true

Table with Auto Scaling

ScalableTarget:
  Type: AWS::ApplicationAutoScaling::ScalableTarget
  Properties:
    MaxCapacity: 100
    MinCapacity: 5
    ResourceId: !Sub "table/${DynamoDBTable}"
    RoleARN: !GetAtt AutoScalingRole.Arn
    ScalableDimension: dynamodb:table:ReadCapacityUnits
    ServiceNamespace: dynamodb

See references/complete-examples.md for more complete examples including encryption, streams, auto scaling, and production tables.

Template Structure

Base Template

AWSTemplateFormatVersion: 2010-09-09
Description: DynamoDB table with GSI and auto-scaling

Parameters:
  TableName:
    Type: String
    Default: my-table
  BillingMode:
    Type: String
    Default: PAY_PER_REQUEST

Resources:
  DynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Ref TableName
      BillingMode: !Ref BillingMode

Outputs:
  TableName:
    Value: !Ref DynamoDBTable
  TableArn:
    Value: !GetAtt DynamoDBTable.Arn

See references/advanced-configuration.md for detailed Parameters, Mappings, Conditions, Outputs, IAM roles, and cross-stack references.

Best Practices

Use PAY_PER_REQUEST for development/testing and unpredictable workloads
Enable Point-In-Time Recovery for production tables
Use KMS encryption for sensitive data (SSE-KMS)
Configure auto-scaling for provisioned capacity tables
Design GSIs carefully - each GSI consumes capacity
Use TTL for automatic data expiration (sessions, cache)
Enable Streams for change data capture and analytics
Tag resources for cost allocation and organization
Export outputs for cross-stack references
Use Conditions for environment-specific configurations

Common Troubleshooting

Table already exists: Use unique table names or stack deletion policy GSI creation fails: Verify attribute definitions include GSI attributes Auto-scaling not working: Check IAM role permissions and service-linked role TTL not expiring: Ensure TTL attribute is Number type, not String Streams not enabled: Can only enable streams during table creation Encryption errors: Verify KMS key exists in same region as table

Related Skills

aws-cloudformation-security - Security best practices for DynamoDB
aws-cloudformation-lambda - Lambda triggers for DynamoDB Streams
aws-cloudformation-iam - IAM roles for DynamoDB access

References

Complete Examples

references/complete-examples.md - Basic tables, GSI, LSI, TTL, encryption, PITR, auto-scaling, production tables, global tables, streams

Advanced Configuration

references/advanced-configuration.md - Parameters, Mappings, Conditions, auto scaling policies, streams, TTL, global tables, outputs, IAM roles, deletion policies

Constraints and Warnings

Table names: Must be unique per region (globally unique for global tables)
GSI limits: Maximum 5 GSIs per table (for single-region tables)
LSI limits: Maximum 5 LSIs per table, same partition key as table
Capacity limits: On-demand has default account limits (40,000 RCUs, 40,000 WCUs)
Auto-scaling: Requires PROVISIONED billing mode (not PAY_PER_REQUEST)
Point-in-time recovery: Can only be enabled during table creation
Streams: Can only be enabled during table creation
Encryption: KMS keys must be in same region as table
TTL: Attribute must be Number type, measured in seconds
Throughput: Each GSI shares provisioned throughput with table
Item size limit: Maximum 400 KB per item
Hot partition: Design keys to avoid hot partition issues

Agent Skills: AWS CloudFormation DynamoDB Patterns

Install this agent skill to your local

Skill Files