Overview

Use this account type to connect DynamoDB Snaps with data sources that use DynamoDB accounts. The account now supports the IAM role using the Authentication Types when setting up the account.

Prerequisites

None.

Limitations and Known Issues

None.

Account Settings

Asterisk ( * ): Indicates a mandatory field.
Suggestion icon ( ): Indicates a list that is dynamically populated based on the configuration.
Expression icon ( ): Indicates the value is an expression (if enabled) or a static value (if disabled). Learn more about Using Expressions in SnapLogic.
Add icon ( ): Indicates that you can add fields in the field set.
Remove icon ( ): Indicates that you can remove fields from the field set.

Field Name	Field Type	Field Dependency	Description

Field Name	Field Type	Field Dependency	Description
Label* Default Value: None Example: DynamoDB IAM Role	String	N/A	Specify a unique label for the account.
AWS Endpoint* Default Value: None Example: xyz876jhnJKBuya9730	String/Expression	N/A	Specify the AWS Endpoint URL. Refer to AWS Service Endpoints for more information.
AWS Region* Default Value: None Example: us-east-1	String/Expression	N/A	Specify the AWS region where the application is running from the allowed values.
Authenthication Type	Dropdown List	N/A	Select either of the following Authentication Types to create your DynamoDB Account: User Credentials IAM Role Learn more about DynamoDB Account Configuration Scenarios. Cross Account IAM Role settings are available in the Account settings dialog box regardless of the Authentication Type you choose.
AWS Access Key ID Default Value: None Example: us-east-1	String /Expression	Appears when you select User Credentials* as Authentication Type.*	Specify the Access Key ID associated with your AWS authentication.
AWS Secret Key Default Value: N/A Example: <Encrypted>	String/Expression	N/A	Specify the Secret Key associated with your AWS authentication.
AWS Security Token Default Value: N/A Example: <Encrypted>	String/Expression	N/A	Specify the Security Token to get access to AWS resources using credentials. Note that only global Security Token Service (STS) regions are supported.
Cross Account IAM Role	Use this field set to configure the cross-account access. Learn more about - Setting up Cross-Account IAM Role.
	Role ARN Default Value: N/A Example: arn:aws:iam::612864912850:role/EC2_to_assume_role	N/A	Specify the Amazon Resource Name (ARN) of the role to assume.
	External ID Default Value: N/A Example: <Encrypted>	N/A	Specify an External ID that might be required by the role to assume.

DynamoDB Account Configuration Scenarios

Scenario	Groundplex Type	Role attached to EC2 instance	Authentication Type and other details

Scenario	Groundplex Type	Role attached to EC2 instance	Authentication Type and other details
When the Groundplex type is an AWS EC2 and the role attached to the EC2 instance is the DynamoDB access role.	AWS EC2-type	DynamoDB access role.	Select Authentication Type as the IAM Role.
When the Groundplex type is an AWS EC2 and the role attached to the EC2 instance is the DynamoDB Cross-account access role.	AWS EC2-type	DynamoDB Cross-account access role.	Select Authentication Type as IAM the Role and provide details for the Cross-account IAM Role.
When you do not have an AWS-EC2 Groundplex and the role attached to the EC2 instance is the DynamoDB access role.	User does not have an AWS-EC2 Groundplex. Value is from local machine.	DynamoDB access role	Select the Authentication Type as User Credentials and provide details for the following fields: AWS Access Key ID AWS Secret Key AWS Security Token (optional)
When you do not have an AWS-EC2 Groundplex and the role attached to the EC2 instance is the DynamoDB Cross-account access role.	User does not have an AWS-EC2 Groundplex. Value is from local machine.	DynamoDB Cross-account access role.	Select Authentication Type as User Credentials and provide details for the following fields: AWS Access Key ID AWS Secret Key AWS Security Token (optional) Cross-account IAM Role

DynamoDB Permissions

The ListTables permission requires all resources (*) to be selected (because it needs to be able to list all the DynamoDB tables), but the others can have policies that are more limited (for example, to a specific table) as per the DynamoDB API Permissions reference. Following is the most basic and permissive Policy document that could be assigned to the user that would guarantee all the required permissions are granted.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1482439123852",
      "Action": [
        "dynamodb:BatchGetItem",
        "dynamodb:BatchWriteItem",
        "dynamodb:DescribeTable",
        "dynamodb:ListTables",
        "dynamodb:Scan",
        "dynamodb:UpdateItem"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

Troubleshooting

Error	Reason	Resolution

Error	Reason	Resolution
Failed to validate account: Failed to connect to service endpoint.	The connection to the host failed.	Verify that the Cross-account IAM role is not attached to the EC2 instance. Refer to https://docs-snaplogic.atlassian.net/wiki/spaces/SD/pages/2671280328/Configure+an+IAM+Role+in+a+DynamoDB+Account#Attach-IAM-Role-to-Instance for additional information.