AWS DynamoDB
Official · maintained by Marmotmarmotdata/dynamodb Discover DynamoDB tables from AWS accounts
The DynamoDB plugin discovers and catalogs Amazon DynamoDB tables across your AWS accounts. It captures table metadata including key schema, billing mode, indexes, encryption settings, TTL, point-in-time recovery, streams, and tags.
Required Permissions
AWS Configuration
See AWS Configuration for the supported AWS configuration options.
Keyless authentication
On Marmot Cloud or Marmot Enterprise the pipeline can present its own identity instead of access keys. Register your Marmot instance as an IAM OIDC identity provider (client id sts.amazonaws.com), create a role whose trust policy allows sts:AssumeRoleWithWebIdentity for that provider with <issuer host>:sub equal to the pipeline's subject, pipeline:<name> as reported by the pipeline API, and set credentials.role_arn and credentials.region. No key exists anywhere; Marmot mints a short-lived token for each run.
In the UI
Point-and-click, no config file needed.
- 1 Open Runs Create pipeline
- 2 Pick AWS DynamoDB from the plugin list.
- 3 Fill in the wizard, set a schedule, save.
With the CLI
Save a YAML config, then run marmot ingest.
name: my-dynamodb-pipeline
runs:
- dynamodb:
# No required fields — see the Configuration tab.$ marmot ingest -c ingest.yamlNot using plugins? Other ways to populate Marmot
Configuration
7 top-level fields. * marks required fields.
tags multiselect Tags to apply to discovered assets
external_links object[] External links to show on all assets
name string Display name for the link
icon string Icon identifier for the link
url string URL to the external resource
filter object Filter discovered assets by name (regex)
include multiselect Include patterns for resource names (regex)
exclude multiselect Exclude patterns for resource names (regex)
credentials object AWS credentials configuration
use_default bool Use AWS credentials from environment or default profile (recommended)
- default
- true
id string AWS access key ID
secret password AWS secret access key
token password AWS session token
profile string AWS profile to use from shared credentials file
role_arn string IAM role to assume with the Marmot identity token (AssumeRoleWithWebIdentity); its trust policy names the Marmot issuer as an OIDC provider. Setting it federates: no keys are needed, and region is required. role, if also set, is assumed on top of it
role string AWS IAM role ARN to assume with AssumeRole from the base credentials (static keys, a profile, the default chain, or role_arn)
role_external_id string External ID for cross-account role assumption
region string AWS region for services
endpoint string Custom endpoint URL for AWS services
tags_to_metadata bool Convert AWS tags to Marmot metadata
include_tags multiselect List of AWS tags to include as metadata. By default, all tags are included.
audience string Audience of the Marmot identity token. Derived from the credentials' federation settings; set it only when the cloud side expects another
Assets emitted
Metadata this plugin attaches to each discovered asset.
FieldsDynamoDB-specific metadata fields.
table_arn stringThe ARN of the DynamoDB table
table_status stringCurrent status of the table (ACTIVE, CREATING, etc.)
creation_date stringDate and time when the table was created
table_class stringTable class (STANDARD or STANDARD_INFREQUENT_ACCESS)
billing_mode stringBilling mode of the table (PROVISIONED or PAY_PER_REQUEST)
read_capacity_units intProvisioned read capacity units
write_capacity_units intProvisioned write capacity units
key_schema stringKey schema of the table (partition and sort keys)
attribute_definitions stringAttribute definitions for the table's key schema
gsi_count intNumber of global secondary indexes
lsi_count intNumber of local secondary indexes
stream_enabled stringWhether DynamoDB Streams is enabled
stream_view_type stringStream view type (KEYS_ONLY, NEW_IMAGE, OLD_IMAGE, NEW_AND_OLD_IMAGES)
encryption_status stringStatus of server-side encryption
encryption_type stringType of server-side encryption (AES256 or KMS)
table_size_bytes intTotal size of the table in bytes
item_count intNumber of items in the table
deletion_protection stringWhether deletion protection is enabled
global_table_replicas stringRegions where global table replicas exist
ttl_status stringTime to Live status (ENABLED or DISABLED)
ttl_attribute stringAttribute name used for Time to Live
continuous_backups stringContinuous backups status (ENABLED or DISABLED)
pitr_status stringPoint-in-time recovery status (ENABLED or DISABLED)
tags objectAWS resource tags