Amazon DynamoDB

Overview

Connect Amazon DynamoDB so AI clients can list and describe tables, create, update, or delete tables, and query, scan, get, put, update, or delete items in your AWS account.

This integration uses the Amazon DynamoDB API with IAM access keys stored encrypted in stackgate.ai. Usage is billed to your AWS account.

Prerequisites

• An AWS account with DynamoDB tables you want AI clients to access (or permission to create new tables)
• A stackgate.ai account

Getting credentials

1. In the AWS IAM console, create an IAM user (or use an existing automation user) with programmatic access.
2. Attach a least-privilege policy. Three common tiers:

Read-only (existing tables)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:ListTables",
                "dynamodb:DescribeTable",
                "dynamodb:GetItem",
                "dynamodb:Query",
                "dynamodb:Scan"
            ],
            "Resource": "*"
        }
    ]
}

Read-write (items on specific tables)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:ListTables",
                "dynamodb:DescribeTable",
                "dynamodb:GetItem",
                "dynamodb:Query",
                "dynamodb:Scan",
                "dynamodb:PutItem",
                "dynamodb:UpdateItem",
                "dynamodb:DeleteItem"
            ],
            "Resource": [
                "arn:aws:dynamodb:YOUR-REGION:YOUR-ACCOUNT-ID:table/YOUR-TABLE",
                "arn:aws:dynamodb:YOUR-REGION:YOUR-ACCOUNT-ID:table/YOUR-TABLE/index/*"
            ]
        }
    ]
}

Table admin (create/update/delete tables)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:ListTables",
                "dynamodb:DescribeTable",
                "dynamodb:CreateTable",
                "dynamodb:UpdateTable",
                "dynamodb:DeleteTable",
                "dynamodb:GetItem",
                "dynamodb:Query",
                "dynamodb:Scan",
                "dynamodb:PutItem",
                "dynamodb:UpdateItem",
                "dynamodb:DeleteItem"
            ],
            "Resource": "*"
        }
    ]
}

3. Create an access key and copy the key ID and secret.
4. In stackgate.ai, open My Integrations → Amazon DynamoDB.
5. Click Activate and enter access key ID, secret access key, AWS region, and optionally a default DynamoDB table name.

For DynamoDB Local or LocalStack, add an optional custom endpoint (e.g. http://localhost:8000).

Using with AI clients

• Dedicated endpoint: POST /mcp/dynamodb with a Sanctum bearer token
• Private gateway: one config for all integrations — use dynamodb__* namespaced tools

Typical workflow:

1. list_tables — discover tables (paginate with exclusive_start_key)
2. describe_table — learn partition/sort keys and GSIs before reads or writes
3. query_table — preferred read path when the partition key is known
4. get_item — fetch one item by full primary key
5. put_item / update_item / delete_item — mutate items (confirm with user)
6. create_table / update_table / delete_table — manage tables (delete_table requires confirm: true)

Keys and items use DynamoDB AttributeValue JSON, for example:

{ "pk": { "S": "user#1" }, "count": { "N": "42" } }

See Documentation for HTTP authentication and private gateway setup.

Troubleshooting

• 422 integration not configured — complete all required credential fields in My Integrations.
• 403 / AccessDenied from AWS — verify IAM policy includes the DynamoDB actions and table ARNs you need.
• table_name is required — pass table_name or set a default table in My Integrations.
• ThrottlingException — DynamoDB throttles when capacity is exceeded. Back off and retry; prefer query_table over repeated scan_table calls.
• 1 MB page limit — Query and Scan return at most 1 MB per call. Paginate with exclusive_start_key / last_evaluated_key.
• delete_table blocked — pass confirm: true only after explicit user approval; this permanently deletes the table.
• AttributeValue format — each attribute must use typed keys (S, N, B, BOOL, M, L, etc.) as in the DynamoDB JSON reference.