## Set up Amazon DynamoDB

URL: https://docs.atlan.com/apps/connectors/database/amazon-dynamodb/how-tos/set-up-amazon-dynamodb

> Learn about set up amazon dynamodb.

:::warning

**🤓 Who can do this?** You will probably need your Amazon DynamoDB administrator to run these commands - you may not have access yourself.

:::

Atlan supports the following authentication methods for fetching metadata from Amazon DynamoDB:

- [IAM user authentication](https://docs.atlan.com/llms/connectors/amazon-dynamodb/set-up-amazon-dynamodb/llms.txt) - this method uses an AWS access key, secret key, and region to fetch metadata.
- [IAM role authentication](https://docs.atlan.com/llms/connectors/amazon-dynamodb/set-up-amazon-dynamodb/llms.txt) - this method uses an AWS role ARN and region to fetch metadata.

## Create IAM policy

To create an IAM policy with the necessary permissions, follow [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html).

Create the policy using the following JSON:

```json
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "dynamodb:ListTables"
 ],
 "Resource": "*"
 },
				{
 "Effect": "Allow",
 "Action": [
 "dynamodb:DescribeTable"
 ],
 "Resource": "arn:aws:dynamodb:<region>:<account_id>:table/*"
 }
 ]
}
```

- Replace `<region>` with the AWS region of your Amazon DynamoDB instance.
- Replace `<account_id>` with your AWS account ID.

## IAM permissions

Atlan requires the following permissions:

- `dynamodb:ListTables`:
 - Fetches a list of your Amazon DynamoDB tables. This permission is used during the metadata extraction process to dynamically determine a list of tables.
 - Note that this action does not support resource-level permissions and requires you to choose all resources, hence `*` for `Resource`.
- `dynamodb:DescribeTable`:
 - Fetches metadata for extracted tables. This action supports resource-level permissions, so for `Resource`, you can either: 
 - Grant permission to all tables in the region for which you want to extract metadata: `arn:aws:dynamodb:<region>:<account_id>:table/*`
 - Specify the table names for which you want to extract metadata: `arn:aws:dynamodb:<region>:<account_id>:table/table_name_1`, `arn:aws:dynamodb:<region>:<account_id>:table/table_name_2`

## Choose authentication mechanism

Using the [policy created above](https://docs.atlan.com/llms/connectors/amazon-dynamodb/set-up-amazon-dynamodb/llms.txt), configure one of the following options for authentication.

### User-based authentication

To configure IAM user-based authentication:

1. Create an AWS IAM user by following [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html).
2. On the _Set permissions_ page, [attach the policy](https://docs.atlan.com/llms/connectors/amazon-dynamodb/set-up-amazon-dynamodb/llms.txt) created in the previous step to this user.
3. Refer to [managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) to create an access key for the new user.
4. Once the user is created, view or download the user's _access key ID_ and _secret access key_.

:::warning

This will be your only opportunity to view or download the access keys. You will not have access to them again after leaving the user creation screen.

:::

### Role delegation-based authentication

To configure role delegation-based authentication:

1. [Raise a support ticket](https://docs.atlan.com/support/submit-request) to get the ARN of the _Node Instance Role_ for your Atlan EKS cluster.
2. Create a new role in your AWS account by following [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html).
 1. When prompted for policies, [attach the policy](https://docs.atlan.com/llms/connectors/amazon-dynamodb/set-up-amazon-dynamodb/llms.txt) created in the previous step to this role.
 2. When prompted, create a trust relationship for the role using the following trust policy. (Replace `<atlan_nodeinstance_role_arn>` with the ARN received from Atlan support.)

 ```json
 {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "<atlan_nodeinstance_role_arn>"
 },
 "Action": "sts:AssumeRole",
 "Condition": {}
 }
 ]
 }
 ```

3. (Optional) To use an [external ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html) for additional security, paste the external ID into the policy: 

 ```json
 {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "<atlan_nodeinstance_role_arn>"
 },
 "Action": "sts:AssumeRole",
 "Condition": {
 "StringEquals": {
 "sts:ExternalId": "<atlan_external_id>"
 }
 }
 }
 ]
 }
 ```

 - Replace `<atlan_external_id>` with the external ID you want to use.
4. Now, [reach out to Atlan support](https://docs.atlan.com/support/submit-request) with:
 - The name of the role you created above.
 - The ID of the AWS account where the role was created.

:::warning

Wait until the support team confirms the account is allowlisted to assume the role before running the crawler.

:::

---