Amazon DynamoDB

What it is

Amazon DynamoDB is a serverless, fully managed NoSQLDatabases that store data in models other than relational tables, such as key-value, document, wide-column, or graph, usually to scale out easily or to handle data whose shape varies. Amazon DynamoDB is a NoSQL database.Glossary entry database that stores key-value and document data with single-digit millisecond performance at any scale. There are no servers, instances, or storage volumes to manage: you create a table, and DynamoDB spreads the data across partitions and scales throughput and storage for you. Every table is replicated across three AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry in its AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry.

Choose DynamoDB when an application reads and writes items by a key, needs predictable low LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry at high or unpredictable request rates, and doesn't need joins or complex SQL (Structured Query Language)The standard language for querying and changing data in relational databases. Analytics services such as Amazon Athena and Amazon Redshift also use SQL.Glossary entry queries. Typical uses are user profiles, shopping carts, session state, gaming, IoT data, and serverless back ends with AWS Lambda and API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry Gateway. For relational data with joins and ad hoc queries, use Amazon RDS or Amazon Aurora.

Concepts

Table, item, attribute: a table holds items (like rows), and each item holds attributes. Apart from the key, items in one table can have different attributes. An item can be up to 400 KB; store larger objects in Amazon S3 and keep a pointer in the item.
Primary key: either a Partition keyThe attribute that DynamoDB hashes to decide which partition stores an item. A primary key is a partition key alone, or a partition key with a sort key; keys with many distinct values spread the load evenly.Glossary entry alone, or a partition key plus Sort keyThe optional second part of a DynamoDB primary key. It orders the items that share a partition key, so that queries can select a range, such as all orders after a date.Glossary entry (a composite key). DynamoDB hashes the partition key to choose a partition, so choose a key with many distinct values and even access, to avoid hot partitions.
Secondary indexes let you query by other attributes:
- GSI (Global secondary index)A DynamoDB index with a different partition key, and optionally a sort key, from its table, so that items can be queried by other attributes. It can be added at any time, and its reads are only eventually consistent.Glossary entry (GSI): a different partition key and sort key. You can add one at any time, with up to 20 per table by default. GSIs are updated asynchronously and support Eventual consistencyA read may briefly return older data after a write, but all copies catch up shortly afterwards. DynamoDB reads are eventually consistent by default and cost half as much as strongly consistent reads.Glossary entry reads only.
- LSI (Local secondary index)A DynamoDB index with the same partition key as its table but a different sort key. It must be created with the table, shares the table's capacity, and supports strongly consistent reads.Glossary entry (LSI): the same partition key with a different sort key. You must create it when you create the table, with up to 5 per table, and it supports Strong consistencyA read always reflects every write that succeeded before it. Amazon S3 is strongly consistent for object reads after writes and deletes; DynamoDB offers strongly consistent reads on request for tables and local secondary indexes.Glossary entry reads. Each partition key value can hold up to 10 GB of data across the table and its LSIs.
Read consistency: reads are eventually consistent by default; you can ask for strongly consistent reads from the table or an LSI.
Transactions: TransactWriteItems and TransactGetItems group up to 100 actions into one all-or-nothing (ACID) operation.
Query vs Scan: a Query reads the items for one partition key and is efficient. A Scan reads the whole table and is slow and costly on large tables.
Vector indexes (new): a type of index for similarity search on vector embeddings stored in table items.

Capacity modes

	On-demand	Provisioned
How it works	Pay per request; no capacity to set	Set RCU (Read capacity unit)The unit of read throughput in DynamoDB: one strongly consistent read per second of an item up to 4 KB, or two eventually consistent reads.Glossary entry (RCUs) and WCU (Write capacity unit)The unit of write throughput in DynamoDB: one write per second of an item up to 1 KB. A transactional write uses two.Glossary entry (WCUs)
Scaling	Automatic; instantly handles up to double the previous peak	Auto scaling (Application Auto Scaling) adjusts capacity to a target utilization
Best for	New, spiky, or unpredictable traffic; the default and recommended option	Steady, predictable traffic, where it can cost less
Saving more	Database Savings Plans	Reserved capacity or Database Savings Plans

Auto scaling reacts over minutes, not instantly: it acts only after consumption stays above the target for a couple of minutes, then takes several minutes to raise capacity, and requests above the old capacity are ThrottlingLimiting how many requests a client can make in a period. A throttled request is rejected, often with HTTP status 429 or a throttling error, and should be retried later with backoff.Glossary entry meanwhile. For sudden, unpredictable spikes, choose on-demand.

Capacity units:

1 RCU gives one strongly consistent read per second, or two eventually consistent reads per second, for an item up to 4 KB.
1 WCU gives one write per second for an item up to 1 KB.
Item sizes round up. A 6 KB strongly consistent read needs 2 RCUs, and a 1.5 KB write needs 2 WCUs.

Features to know

DynamoDB Accelerator (DAX): an in-memory cache cluster, in your VPC, that cuts read times from milliseconds to microseconds for eventually consistent reads. It uses the same API, so you only change the client. It isn't suitable for applications that need strongly consistent reads.
DynamoDB Streams: a time-ordered log of item changes, kept for 24 hours, that can trigger Lambda functions. Use it for Event-driven architectureA design in which services react to events that other services emit, such as an order placed or a file uploaded, instead of calling each other directly. Amazon EventBridge, Amazon SNS, Amazon SQS, and AWS Lambda are common building blocks.Glossary entry processing, replication, or audit trails. Kinesis Data Streams for DynamoDB sends changes to a Kinesis data stream instead, for longer retention and more consumers.
Global tables: multi-active replicas of a table in several Regions, where every replica accepts reads and writes. There are two consistency modes:
- Multi-Region eventual consistency (MREC) is the default. Conflicts resolve as last writer wins.
- Multi-Region strong consistency (MRSC) gives strongly consistent reads across Regions and an RPO (Recovery point objective)The most data, measured in time, that a workload can afford to lose in a disaster. With an RPO of one hour, data must be restorable to no more than an hour before the failure.Glossary entry of zero. It runs in exactly three Regions, or two Regions plus a witness, at the cost of higher write latency.
- Global tables have a 99.999% availability SLA (Service level agreement)A provider's commitment to a level of service, such as a monthly uptime percentage, and what customers receive if it is missed, usually service credits.Glossary entry, compared with 99.99% for a single-Region table.
TTL (Time to live)How long something stays valid before it expires. A DNS record or cached item can be reused until its TTL runs out, then is fetched again; in DynamoDB, a TTL attribute deletes items after a set time.Glossary entry (TTL): set an expiry timestamp attribute, and DynamoDB deletes expired items within a few days, without using write capacity. Use it for sessions, temporary data, and old logs. Expired items can still be read until they are deleted, so an application that must never use expired data should filter on the expiry attribute when it reads.
Export to S3 and import from S3: export a table from any point in the PITR (Point-in-time recovery)Restoring a database to its state at a chosen moment within a retention period, using continuous backups. Amazon RDS, Amazon Aurora, Amazon DynamoDB, and AWS Backup support it.Glossary entry window to S3 for analytics with Athena. Exports don't consume read capacity or affect table performance, whereas a Scan, or a Redshift COPY from the table, reads the live table and consumes its read capacity.

DAX and DynamoDB Streams. An application sends reads and writes through a DAX cluster, which serves reads in microseconds and goes to the DynamoDB table on a cache miss. Item changes in the table flow into DynamoDB Streams, kept for 24 hours, which trigger a Lambda function.

DynamoDB global tables. An application in Region A reads and writes its local replica, and an application in Region B reads and writes the replica in Region B. The two replicas replicate changes to each other.

Security, resilience, performance, and cost

Security

IAM controls every API call; there are no database users. Fine-grained access control with the dynamodb:LeadingKeys condition key limits users to the items whose partition key matches their identity, for example in a mobile app with Amazon Cognito. Resource-based policyA permissions policy attached to a resource, such as an S3 bucket policy or an SQS queue policy, that says which principals can use it, including principals in other accounts. Identity-based policies, in contrast, attach to users, groups, and roles.Glossary entry can grant cross-account access.
Encryption at restEncrypting data where it is stored, such as on disks, in databases, or in backups, so that it cannot be read without the key. On AWS it usually uses keys in AWS KMS.Glossary entry is always on, with an AWS owned key (the default), an AWS managed key, or a Customer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entry in KMS. You can switch between them at any time. Traffic uses HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry.
VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry: a gateway endpoint (no charge) lets instances in SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry reach DynamoDB through the route table without a NAT gatewayA managed VPC component that lets instances in private subnets start connections to the internet or other networks, while blocking connections started from outside. It is billed per hour and per gigabyte processed.Glossary entry or internet gateway. An interface endpoint (AWS PrivateLink) also works from On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry or other Regions.
CloudTrail logs control-plane calls, and you can turn on data-plane event logging.
Deletion protection prevents a table from being deleted by mistake.

Resilience

Data is replicated across three Availability Zones automatically, with a 99.99% availability SLA for a single-Region table.
Point-in-time recovery (PITR) restores to any second in a recovery period of 1 to 35 days. On-demand backups are full backups you create at any time for long-term retention, and AWS Backup adds schedules, cross-Region copies, and cross-account copies. Restores always create a new table.
Use global tables for multi-Region resilience and DR (Disaster recovery)Preparing for and recovering from events that take a workload down, such as a Regional outage or deleted data. AWS describes four strategies, from cheapest and slowest to costliest and fastest: backup and restore, pilot light, warm standby, and multi-site active/active.Glossary entry.

Performance

Design keys for even access across partitions, and use Query with indexes rather than Scan.
Add DAX for microsecond reads of hot items, and use warm throughput to pre-warm a table before a known launch or traffic spike.

Cost

On-demand: pay per read and write request. Provisioned: pay per hour for RCUs and WCUs, whether used or not.
Pay for storage, backups, PITR, global table replication, Streams reads, and DAX nodes.
The Standard-Infrequent Access (Standard-IA) table class lowers storage cost for tables where storage is the main cost and the data is rarely read, such as old orders or logs.
Save with Database Savings Plans, or with reserved capacity for provisioned mode. Use TTL to delete data you no longer need at no cost.

Monitoring

CloudWatch metrics show consumed capacity, throttled requests, latency, and errors; set alarms on throttling.
CloudWatch Contributor Insights for DynamoDB shows the most accessed and most throttled keys, which helps find hot partitions.

DynamoDB or another option?

If the requirement is	Choose
Key-value or document access at any scale, serverless	Amazon DynamoDB
Relational data with joins and SQL	Amazon RDS or Aurora
An existing MongoDB application	Amazon DocumentDB
An existing Apache Cassandra application	Amazon Keyspaces
A general-purpose cache in front of any database	Amazon ElastiCache
A cache just for DynamoDB, with no code changes beyond the client	DAX
Analytics over the data	Export to S3 and query with Athena, or Amazon Redshift

Reverse mindmap: when the question points here

Is it Amazon DynamoDB?

Yes, when the question says
- Serverless NoSQL, key-value or document leads to DynamoDB
- Single-digit millisecond latency at any scale leads to DynamoDB
- Session state, carts, or profiles for a serverless app leads to DynamoDB
Choose the feature
- Unpredictable traffic, no capacity planning leads to On-demand mode
- Sudden spikes throttled while auto scaling catches up leads to On-demand mode
- Steady traffic at the lowest cost leads to Provisioned with auto scaling
- Microsecond reads, no app rewrite leads to DAX
- React to item changes with Lambda leads to DynamoDB Streams
- Active-active writes in several Regions leads to Global tables
- Multi-Region with zero RPO leads to Global tables in MRSC mode
- Delete old items automatically at no cost leads to TTL
- Never use expired items before TTL deletes them leads to Filter on the expiry attribute
- SQL analytics without using table read capacity leads to Export to S3, query with Athena
- Query by a different attribute, added later leads to Global secondary index
- Same partition key, different sort order, strong reads leads to Local secondary index
- All-or-nothing writes across items leads to Transactions
Protect and connect it
- Restore to a second in the last 35 days leads to Point-in-time recovery
- Private access without NAT leads to Gateway VPC endpoint
- Users see only their own items leads to IAM LeadingKeys condition
- Mostly old, rarely read data leads to Standard-IA table class
No, when the question says
- Joins and complex SQL leads to RDS or Aurora
- Items larger than 400 KB leads to Store in S3, keep a pointer

Key takeaways

DynamoDB is serverless NoSQL with single-digit millisecond latency, stored across three Availability Zones.
Items are up to 400 KB; choose a high-cardinality partition key; GSIs can be added any time (eventual reads), and LSIs only at table creation.
On-demand for unpredictable traffic; provisioned with auto scaling for steady traffic. 1 RCU = one strong (or two eventual) 4 KB reads per second; 1 WCU = one 1 KB write per second.
DAX gives microsecond cached reads; Streams feeds Lambda; global tables give multi-Region, multi-active replication.
PITR covers 1 to 35 days; restores create a new table; encryption at rest is always on.
A gateway VPC endpoint gives private access with no NAT gateway.