Amazon DynamoDB

Connect to Amazon DynamoDB with PartiQL queries, GSI/LSI browsing, and DynamoDB Local support

TablePro connects to Amazon DynamoDB over the AWS HTTP API. Sign in with IAM credentials, an AWS profile, or SSO. Browse tables, run PartiQL queries, inspect GSI and LSI indexes, and edit items in the data grid.

Quick Setup

Click New Connection, select DynamoDB, choose an auth method, enter your credentials and region, then click Save & Connect. The plugin auto-installs when you pick DynamoDB, or install it from Settings > Plugins > Browse > DynamoDB Driver.

Authentication Methods

Access Key + Secret Key: IAM credentials. Add a session token if you are using temporary credentials from STS.

AWS Profile: Reads the named profile from both ~/.aws/config and ~/.aws/credentials, the same way the AWS CLI does. A profile can supply static keys (aws_access_key_id, aws_secret_access_key, optional aws_session_token) or a credential_process command. Profiles defined only in ~/.aws/config (as [profile name]) resolve too.

AWS SSO: Reads the cached SSO token from ~/.aws/sso/cache/. Run aws sso login --profile my-sso-profile before connecting. Tokens expire; the connection re-resolves credentials automatically and tells you to re-run aws sso login when the session has ended.

Connection Settings

Field	Description
Auth Method	Access Key + Secret Key, AWS Profile, or AWS SSO
Access Key ID	IAM access key, e.g. AKIA.... Access Key auth only
Secret Access Key	The matching secret. Access Key auth only
Session Token	Optional token for temporary STS credentials. Access Key auth only
Profile Name	Profile to read from ~/.aws/config or ~/.aws/credentials. AWS Profile and AWS SSO only
AWS Region	Region your tables live in. Defaults to us-east-1
Custom Endpoint	Overrides the DynamoDB endpoint URL. Leave it empty unless you run DynamoDB Local

DynamoDB Local

Start a local instance:

docker run -p 8000:8000 amazon/dynamodb-local

Set Auth Method to Access Key + Secret Key, put any non-empty string in Access Key ID and Secret Access Key, and set Custom Endpoint to http://localhost:8000.

Features

Table Browsing: The sidebar lists every table. Open one to see its data, its structure (attribute names and types), its indexes (primary key, GSI, LSI), and its DDL (key schema, billing mode, throughput, item count, and size).

Schemaless Discovery: DynamoDB tables have no fixed schema, so TablePro reads the attribute names from the items it fetched and picks each column’s type by majority vote. The Structure tab samples up to 100 items. Partition and sort keys come first, then the other attributes in alphabetical order.

PartiQL Queries (reference):

-- Select items
SELECT * FROM "Users" WHERE userId = 'user123'

-- Insert an item
INSERT INTO "Users" VALUE {'userId': 'user456', 'name': 'Alice', 'age': 30}

-- Update an item
UPDATE "Users" SET name = 'Bob' WHERE userId = 'user123'

-- Delete an item
DELETE FROM "Users" WHERE userId = 'user123'

-- Query with conditions
SELECT * FROM "Orders"
WHERE customerId = 'cust001' AND orderDate BETWEEN '2024-01-01' AND '2024-12-31'

Table names in PartiQL must be quoted with double quotes: "TableName". String values use single quotes: 'value'.

Data Types: S (string), N (number), B (binary), BOOL, NULL, L (JSON array), M (JSON object), SS (string set), NS (number set), BS (binary set).

Data Editing: Edit cells, insert rows, and delete rows. TablePro generates PartiQL: INSERT INTO "Table" VALUE { ... }, UPDATE "Table" SET attr = 'val' WHERE pk = 'pkVal', and DELETE FROM "Table" WHERE pk = 'pkVal'. Key attributes cannot be changed, so delete the item and insert it again.

Query Instead of Scan: A filter that pins the partition key to a single value with = runs through the Query API instead of Scan. It returns faster and burns less read capacity.

Capacity and Metrics: Billing mode (PAY_PER_REQUEST, or PROVISIONED with read and write capacity units), approximate item count, table size, and GSI/LSI details.

Export: CSV, JSON, SQL, XLSX formats.

IAM Permissions

The IAM user or role needs these permissions at minimum:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:ListTables",
        "dynamodb:DescribeTable",
        "dynamodb:Scan",
        "dynamodb:Query",
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:PartiQLSelect",
        "dynamodb:PartiQLInsert",
        "dynamodb:PartiQLUpdate",
        "dynamodb:PartiQLDelete"
      ],
      "Resource": "*"
    }
  ]
}

For read-only access, remove the write actions (PutItem, UpdateItem, DeleteItem, PartiQLInsert, PartiQLUpdate, PartiQLDelete).

Troubleshooting

Auth failed: Check the access key and secret, the profile name, or the SSO session. For SSO, run aws sso login --profile my-sso-profile. If you pasted a temporary session token, get a fresh one from STS.

Access denied: Check the IAM policy on the user or role, the resource ARNs it covers, and any service control policies or permission boundaries above it.

Region mismatch: Tables are region-specific. Make sure AWS Region matches the region the table was created in.

Throughput exceeded: Wait and retry, switch the table to on-demand billing, or add filters so fewer items are scanned.

Limitations

• Every request is an independent HTTPS call signed with SigV4. There are no persistent connections and no SSH tunneling.
• Table structure is fixed when the table is created. TablePro cannot edit it.
• Item counts come from DynamoDB and refresh about every 6 hours, so they lag.
• Pagination is cursor-based, so jumping to a far page re-scans from the start.
• No transactions.
• DAX endpoints are not supported. Connect to the standard DynamoDB endpoint.