This page provides a reference for AWS DynamoDB actions available in the workflow automation actions catalog. Use these actions to read, write, update, and delete items in DynamoDB tables, and to inspect or modify table configuration directly from a workflow definition.
Prerequisites
For prerequisites and credentials setup, see Set up AWS credentials.
All DynamoDB actions accept the same auth inputs. Use awsRoleArn (recommended) or the access key pair.
Put an item
The action identifier is aws.dynamodb.putItem.
Creates a new item, or replaces an existing item, in a DynamoDB table. Uses the DynamoDB low-level AttributeValue format for the item map.
The following table describes the input fields for this action.
Input | Type | Description | Example |
|---|---|---|---|
| String | Required. AWS region of the target table. |
|
| String | Required. Name of the DynamoDB table. |
|
| Map | Required. A map of attribute name/value pairs in low-level DynamoDB AttributeValue format. Only primary key attributes are required; other attributes are optional. |
|
| String | Optional. IAM role ARN to assume for AWS API calls. |
|
| String | Optional. AWS access key ID. Pass as a secret. |
|
| String | Optional. AWS secret access key. Pass as a secret. |
|
| String | Optional. Temporary session token for STS authentication. Pass as a secret. |
|
| String | Optional. A condition that must be satisfied for the |
|
| Map | Optional. Substitution tokens for attribute names in expressions. Use |
|
| Map | Optional. Substitution values for expressions in low-level AttributeValue format. Use |
|
| Map | Optional. Passthrough for any |
|
| List | Optional. JQ selectors to extract specific fields from the action output. |
|
The following table describes the output fields for this action.
Output | Type | Example |
|---|---|---|
| Boolean |
|
| Object | Raw |
| String | Error message on failure. |
Example
name: put-dynamodb-itemdescription: Write an order item to DynamoDBsteps: - name: putOrderItem type: action action: aws.dynamodb.putItem version: '1' inputs: awsRoleArn: ${{ :secrets:awsRoleArn }} region: us-east-2 tableName: Orders item: orderId: { "S": "123" } status: { "S": "PLACED" } next: endGet an item
The action identifier is aws.dynamodb.getItem.
Retrieves a single item from a DynamoDB table by its primary key.
The following table describes the input fields for this action.
Input | Type | Description | Example |
|---|---|---|---|
| String | Required. AWS region of the target table. |
|
| String | Required. Name of the DynamoDB table. |
|
| Map | Required. The primary key of the item to retrieve, in low-level AttributeValue format. |
|
| String | Optional. IAM role ARN to assume for AWS API calls. |
|
| String | Optional. AWS access key ID. Pass as a secret. |
|
| String | Optional. AWS secret access key. Pass as a secret. |
|
| String | Optional. Temporary session token for STS authentication. Pass as a secret. |
|
| String | Optional. Comma-separated list of attributes to retrieve. If omitted, all attributes are returned. |
|
| Map | Optional. Substitution tokens for attribute names in expressions. Use |
|
| Boolean | Optional. If |
|
| Map | Optional. Passthrough for any |
|
| List | Optional. JQ selectors to extract specific fields from the action output. |
|
The following table describes the output fields for this action.
Output | Type | Example |
|---|---|---|
| Boolean |
|
| Object | Contains |
| String | Error message on failure. |
Example
name: get-dynamodb-itemdescription: Retrieve an order item from DynamoDB by primary keysteps: - name: getOrderItem type: action action: aws.dynamodb.getItem version: '1' inputs: awsRoleArn: ${{ :secrets:awsRoleArn }} region: us-east-2 tableName: Orders key: orderId: { "S": "123" } selectors: - name: item expression: '.response.Item' next: endUpdate an item
The action identifier is aws.dynamodb.updateItem.
Edits an existing item's attributes, or adds a new item if it does not already exist.
The following table describes the input fields for this action.
Input | Type | Description | Example |
|---|---|---|---|
| String | Required. AWS region of the target table. |
|
| String | Required. Name of the DynamoDB table. |
|
| Map | Required. The primary key of the item to update, in low-level AttributeValue format. |
|
| String | Optional. IAM role ARN to assume for AWS API calls. |
|
| String | Optional. AWS access key ID. Pass as a secret. |
|
| String | Optional. AWS secret access key. Pass as a secret. |
|
| String | Optional. Temporary session token for STS authentication. Pass as a secret. |
|
| String | Optional. Defines attributes to update. Supports |
|
| String | Optional. A condition that must be satisfied for the |
|
| Map | Optional. Substitution tokens for attribute names in expressions. Use |
|
| Map | Optional. Substitution values for expressions in low-level AttributeValue format. |
|
| Map | Optional. Passthrough for any |
|
| List | Optional. JQ selectors to extract specific fields from the action output. |
|
The following table describes the output fields for this action.
Output | Type | Example |
|---|---|---|
| Boolean |
|
| Object | Contains |
| String | Error message on failure. |
Example
name: update-dynamodb-itemdescription: Update the status of an order in DynamoDBsteps: - name: updateOrderStatus type: action action: aws.dynamodb.updateItem version: '1' inputs: awsRoleArn: ${{ :secrets:awsRoleArn }} region: us-east-2 tableName: Orders key: orderId: { "S": "123" } updateExpression: 'SET #s = :status' expressionAttributeNames: '#s': status expressionAttributeValues: ':status': { "S": "SHIPPED" } parameters: ReturnValues: UPDATED_NEW selectors: - name: attributes expression: '.response.Attributes' next: endDelete an item
The action identifier is aws.dynamodb.deleteItem.
Deletes a single item from a DynamoDB table by its primary key.
The following table describes the input fields for this action.
Input | Type | Description | Example |
|---|---|---|---|
| String | Required. AWS region of the target table. |
|
| String | Required. Name of the DynamoDB table. |
|
| Map | Required. The primary key of the item to delete, in low-level AttributeValue format. |
|
| String | Optional. IAM role ARN to assume for AWS API calls. |
|
| String | Optional. AWS access key ID. Pass as a secret. |
|
| String | Optional. AWS secret access key. Pass as a secret. |
|
| String | Optional. Temporary session token for STS authentication. Pass as a secret. |
|
| String | Optional. A condition that must be satisfied for the |
|
| Map | Optional. Substitution tokens for attribute names in expressions. |
|
| Map | Optional. Substitution values for expressions in low-level AttributeValue format. |
|
| Map | Optional. Passthrough for any |
|
| List | Optional. JQ selectors to extract specific fields from the action output. |
|
The following table describes the output fields for this action.
Output | Type | Example |
|---|---|---|
| Boolean |
|
| Object | Contains |
| String | Error message on failure. |
Example
name: delete-dynamodb-itemdescription: Delete an order item from DynamoDBsteps: - name: deleteOrderItem type: action action: aws.dynamodb.deleteItem version: '1' inputs: awsRoleArn: ${{ :secrets:awsRoleArn }} region: us-east-2 tableName: Orders key: orderId: { "S": "123" } next: endScan a table
The action identifier is aws.dynamodb.scan.
Returns items from a DynamoDB table or index by scanning the entire table, with optional filtering. A single scan response is limited to 100 KB by Workflow Automation (DynamoDB's own limit is 1 MB). Use limit and exclusiveStartKey to paginate through large tables.
중요
Workflow Automation enforces a 100 KB output size limit per action. aws.dynamodb.scan throws an output size limit exceeded exception when the response exceeds this limit, even though it may be within DynamoDB's own 1 MB per-response cap. Use limit and exclusiveStartKey to paginate results and stay within this limit.
The following table describes the input fields for this action.
Input | Type | Description | Example |
|---|---|---|---|
| String | Required. AWS region of the target table. |
|
| String | Required. Name of the DynamoDB table. |
|
| String | Optional. IAM role ARN to assume for AWS API calls. |
|
| String | Optional. AWS access key ID. Pass as a secret. |
|
| String | Optional. AWS secret access key. Pass as a secret. |
|
| String | Optional. Temporary session token for STS authentication. Pass as a secret. |
|
| String | Optional. Name of a local or global secondary index to scan instead of the base table. |
|
| String | Optional. A condition applied after items are read. Filtered items are not returned but still consume read capacity. |
|
| String | Optional. Comma-separated list of attributes to retrieve. If omitted, all attributes are returned. |
|
| Map | Optional. Substitution tokens for attribute names in expressions. |
|
| Map | Optional. Substitution values for expressions in low-level AttributeValue format. |
|
| String | Optional. Attributes to return. Allowed values: |
|
| Integer | Optional. Maximum number of items to evaluate (not necessarily items returned). Minimum: 1. |
|
| Boolean | Optional. If |
|
| Map | Optional. Primary key of the first item to evaluate. Use the |
|
| Integer | Optional. Total number of segments for a parallel scan. Must be used with |
|
| Integer | Optional. Zero-based segment ID for a parallel scan. Must be used with |
|
| Map | Optional. Passthrough for any |
|
| List | Optional. JQ selectors to extract specific fields from the action output. |
|
The following table describes the output fields for this action.
Output | Type | Example |
|---|---|---|
| Boolean |
|
| Object | Contains |
| String | Error message on failure. |
Example
name: scan-dynamodb-tabledescription: Scan for active orders in DynamoDBsteps: - name: scanActiveOrders type: action action: aws.dynamodb.scan version: '1' inputs: awsRoleArn: ${{ :secrets:awsRoleArn }} region: us-east-2 tableName: Orders filterExpression: '#s = :status' expressionAttributeNames: '#s': status expressionAttributeValues: ':status': { "S": "ACTIVE" } limit: 50 selectors: - name: items expression: '.response.Items' - name: lastKey expression: '.response.LastEvaluatedKey' next: endQuery a table
The action identifier is aws.dynamodb.query.
Returns items from a DynamoDB table or index that match a partition key, optionally narrowed by a sort-key condition or filter expression. More efficient than scan for key-based lookups.
중요
Workflow Automation enforces a 100 KB output size limit per action. aws.dynamodb.query throws an output size limit exceeded exception when the response exceeds this limit, even though it may be within DynamoDB's own 1 MB per-response cap. Use limit and exclusiveStartKey to paginate results and stay within this limit.
The following table describes the input fields for this action.
Input | Type | Description | Example |
|---|---|---|---|
| String | Required. AWS region of the target table. |
|
| String | Required. Name of the DynamoDB table. |
|
| String | Optional. IAM role ARN to assume for AWS API calls. |
|
| String | Optional. AWS access key ID. Pass as a secret. |
|
| String | Optional. AWS secret access key. Pass as a secret. |
|
| String | Optional. Temporary session token for STS authentication. Pass as a secret. |
|
| String | Optional. Name of a local or global secondary index to query. |
|
| String | Optional. Condition on the partition key (required) and optionally the sort key. |
|
| String | Optional. A condition applied after items are read. Cannot reference key attributes. Filtered items are not returned but still consume read capacity. |
|
| String | Optional. Comma-separated list of attributes to retrieve. |
|
| Map | Optional. Substitution tokens for attribute names in expressions. |
|
| Map | Optional. Substitution values for expressions in low-level AttributeValue format. |
|
| String | Optional. Attributes to return. Allowed values: |
|
| Integer | Optional. Maximum number of items to evaluate. Minimum: 1. |
|
| Boolean | Optional. If |
|
| Boolean | Optional. If |
|
| Map | Optional. Primary key of the first item to evaluate. Use the |
|
| Map | Optional. Passthrough for any |
|
| List | Optional. JQ selectors to extract specific fields from the action output. |
|
The following table describes the output fields for this action.
Output | Type | Example |
|---|---|---|
| Boolean |
|
| Object | Contains |
| String | Error message on failure. |
Example
name: query-dynamodb-tabledescription: Query orders by customer IDsteps: - name: queryCustomerOrders type: action action: aws.dynamodb.query version: '1' inputs: awsRoleArn: ${{ :secrets:awsRoleArn }} region: us-east-2 tableName: Orders indexName: customerId-index keyConditionExpression: 'customerId = :cid' expressionAttributeValues: ':cid': { "S": "cust-1" } selectors: - name: items expression: '.response.Items' next: endDescribe a table
The action identifier is aws.dynamodb.describeTable.
Returns table information including status, primary key schema, provisioned throughput, and (for global tables) replica status.
The following table describes the input fields for this action.
Input | Type | Description | Example |
|---|---|---|---|
| String | Required. AWS region of the target table. |
|
| String | Required. Name of the DynamoDB table. |
|
| String | Optional. IAM role ARN to assume for AWS API calls. |
|
| String | Optional. AWS access key ID. Pass as a secret. |
|
| String | Optional. AWS secret access key. Pass as a secret. |
|
| String | Optional. Temporary session token for STS authentication. Pass as a secret. |
|
| List | Optional. JQ selectors to extract specific fields from the action output. |
|
The following table describes the output fields for this action.
Output | Type | Example |
|---|---|---|
| Boolean |
|
| Object | Contains |
| String | Error message on failure. |
Example
name: describe-dynamodb-tabledescription: Get the status and configuration of a DynamoDB tablesteps: - name: describeOrdersTable type: action action: aws.dynamodb.describeTable version: '1' inputs: awsRoleArn: ${{ :secrets:awsRoleArn }} region: us-east-2 tableName: Orders selectors: - name: tableStatus expression: '.response.Table.TableStatus' next: endList tables
The action identifier is aws.dynamodb.listTables.
Returns a list of DynamoDB table names in the current AWS account and region. Results are paginated — use exclusiveStartTableName with the LastEvaluatedTableName from a previous response to page through results.
The following table describes the input fields for this action.
Input | Type | Description | Example |
|---|---|---|---|
| String | Required. AWS region to list tables in. |
|
| String | Optional. IAM role ARN to assume for AWS API calls. |
|
| String | Optional. AWS access key ID. Pass as a secret. |
|
| String | Optional. AWS secret access key. Pass as a secret. |
|
| String | Optional. Temporary session token for STS authentication. Pass as a secret. |
|
| String | Optional. First table name to evaluate. Use the |
|
| Integer | Optional. Maximum number of table names to return (1–100). Default: 100. |
|
| List | Optional. JQ selectors to extract specific fields from the action output. |
|
The following table describes the output fields for this action.
Output | Type | Example |
|---|---|---|
| Boolean |
|
| Object | Contains |
| String | Error message on failure. |
Example
name: list-dynamodb-tablesdescription: List all DynamoDB tables in a regionsteps: - name: listDynamoTables type: action action: aws.dynamodb.listTables version: '1' inputs: awsRoleArn: ${{ :secrets:awsRoleArn }} region: us-east-2 selectors: - name: tableNames expression: '.response.TableNames' next: endUpdate a table
The action identifier is aws.dynamodb.updateTable.
Modifies the provisioned throughput settings, billing mode, global secondary indexes, replication regions, or other settings of a DynamoDB table.
The following table describes the input fields for this action.
Input | Type | Description | Example |
|---|---|---|---|
| String | Required. AWS region of the target table. |
|
| String | Required. Name of the DynamoDB table. |
|
| String | Optional. IAM role ARN to assume for AWS API calls. |
|
| String | Optional. AWS access key ID. Pass as a secret. |
|
| String | Optional. AWS secret access key. Pass as a secret. |
|
| String | Optional. Temporary session token for STS authentication. Pass as a secret. |
|
| List | Optional. Array of attribute definitions for the table and indexes. Required when adding a new global secondary index. |
|
| String | Optional. Controls how throughput is charged. Allowed values: |
|
| Map | Optional. Required when |
|
| List | Optional. One or more global secondary index update actions (create, update, or delete). Maximum 20 GSIs per table. |
|
| Map | Optional. Settings for DynamoDB Streams. |
|
| Map | Optional. Server-side encryption settings. |
|
| Boolean | Optional. Enable or disable deletion protection on the table. |
|
| Map | Optional. Passthrough for any |
|
| List | Optional. JQ selectors to extract specific fields from the action output. |
|
The following table describes the output fields for this action.
Output | Type | Example |
|---|---|---|
| Boolean |
|
| Object | Contains |
| String | Error message on failure. |
Example
name: update-dynamodb-tabledescription: Switch a DynamoDB table to on-demand billingsteps: - name: setPayPerRequest type: action action: aws.dynamodb.updateTable version: '1' inputs: awsRoleArn: ${{ :secrets:awsRoleArn }} region: us-east-2 tableName: Orders billingMode: PAY_PER_REQUEST selectors: - name: tableStatus expression: '.response.TableDescription.TableStatus' next: end