• /
  • EnglishEspañolFrançais日本語한국어Português
  • EntrarComeçar agora

AWS DynamoDB actions

|View as Markdown (English)

This page provides a reference for AWS DynamoDB actions available in the workflow automation actions catalog. Use these actions to read, write, update, and delete items in DynamoDB tables, and to inspect or modify table configuration directly from a workflow definition.

Prerequisites

For prerequisites and credentials setup, see Set up AWS credentials.

All DynamoDB actions accept the same auth inputs. Use awsRoleArn (recommended) or the access key pair.

Put an item

The action identifier is aws.dynamodb.putItem.

Creates a new item, or replaces an existing item, in a DynamoDB table. Uses the DynamoDB low-level AttributeValue format for the item map.

The following table describes the input fields for this action.

Input

Type

Description

Example

region

String

Required. AWS region of the target table.

us-east-2

tableName

String

Required. Name of the DynamoDB table.

Orders

item

Map

Required. A map of attribute name/value pairs in low-level DynamoDB AttributeValue format. Only primary key attributes are required; other attributes are optional.

{"id": {"S": "123"}, "status": {"S": "PLACED"}}

awsRoleArn

String

Optional. IAM role ARN to assume for AWS API calls.

arn:aws:iam::123456789012:role/my-workflow-role

awsAccessKeyId

String

Optional. AWS access key ID. Pass as a secret.

${{ :secrets:awsAccessKeyId }}

awsSecretAccessKey

String

Optional. AWS secret access key. Pass as a secret.

${{ :secrets:awsSecretAccessKey }}

awsSessionToken

String

Optional. Temporary session token for STS authentication. Pass as a secret.

${{ :secrets:awsSessionToken }}

conditionExpression

String

Optional. A condition that must be satisfied for the PutItem to succeed. Supports functions (attribute_exists, attribute_not_exists, contains), comparison operators, and logical operators (AND, OR, NOT).

attribute_not_exists(id)

expressionAttributeNames

Map

Optional. Substitution tokens for attribute names in expressions. Use #name syntax to reference reserved words or special characters.

{"#n": "name"}

expressionAttributeValues

Map

Optional. Substitution values for expressions in low-level AttributeValue format. Use :value syntax.

{":id": {"S": "123"}}

parameters

Map

Optional. Passthrough for any put_item field not modeled above. Field names must use boto3 PascalCase. Common values: ReturnValues (NONE default | ALL_OLD), ReturnConsumedCapacity (NONE default | TOTAL | INDEXES), ReturnValuesOnConditionCheckFailure (NONE default | ALL_OLD). See the PutItem API reference.

{"ReturnValues": "ALL_OLD"}

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "attributes", "expression": ".response.Attributes"}]

The following table describes the output fields for this action.

Output

Type

Example

success

Boolean

true or false

response

Object

Raw put_item response. Contains Attributes if ReturnValues is set via parameters. See the PutItem API reference.

errorMessage

String

Error message on failure.

Example

name: put-dynamodb-item
description: Write an order item to DynamoDB
steps:
- name: putOrderItem
type: action
action: aws.dynamodb.putItem
version: '1'
inputs:
awsRoleArn: ${{ :secrets:awsRoleArn }}
region: us-east-2
tableName: Orders
item:
orderId: { "S": "123" }
status: { "S": "PLACED" }
next: end

Get an item

The action identifier is aws.dynamodb.getItem.

Retrieves a single item from a DynamoDB table by its primary key.

The following table describes the input fields for this action.

Input

Type

Description

Example

region

String

Required. AWS region of the target table.

us-east-2

tableName

String

Required. Name of the DynamoDB table.

Orders

key

Map

Required. The primary key of the item to retrieve, in low-level AttributeValue format.

{"orderId": {"S": "123"}}

awsRoleArn

String

Optional. IAM role ARN to assume for AWS API calls.

arn:aws:iam::123456789012:role/my-workflow-role

awsAccessKeyId

String

Optional. AWS access key ID. Pass as a secret.

${{ :secrets:awsAccessKeyId }}

awsSecretAccessKey

String

Optional. AWS secret access key. Pass as a secret.

${{ :secrets:awsSecretAccessKey }}

awsSessionToken

String

Optional. Temporary session token for STS authentication. Pass as a secret.

${{ :secrets:awsSessionToken }}

projectionExpression

String

Optional. Comma-separated list of attributes to retrieve. If omitted, all attributes are returned.

id, #n

expressionAttributeNames

Map

Optional. Substitution tokens for attribute names in expressions. Use #name syntax to reference reserved words or special characters.

{"#n": "name"}

consistentRead

Boolean

Optional. If true, uses strongly consistent reads. Default: false (eventually consistent).

false

parameters

Map

Optional. Passthrough for any get_item field not modeled above. Common value: ReturnConsumedCapacity (NONE default | TOTAL | INDEXES). See the GetItem API reference.

{"ReturnConsumedCapacity": "TOTAL"}

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "item", "expression": ".response.Item"}]

The following table describes the output fields for this action.

Output

Type

Example

success

Boolean

true or false

response

Object

Contains Item if the item was found. See the GetItem API reference.

errorMessage

String

Error message on failure.

Example

name: get-dynamodb-item
description: Retrieve an order item from DynamoDB by primary key
steps:
- name: getOrderItem
type: action
action: aws.dynamodb.getItem
version: '1'
inputs:
awsRoleArn: ${{ :secrets:awsRoleArn }}
region: us-east-2
tableName: Orders
key:
orderId: { "S": "123" }
selectors:
- name: item
expression: '.response.Item'
next: end

Update an item

The action identifier is aws.dynamodb.updateItem.

Edits an existing item's attributes, or adds a new item if it does not already exist.

The following table describes the input fields for this action.

Input

Type

Description

Example

region

String

Required. AWS region of the target table.

us-east-2

tableName

String

Required. Name of the DynamoDB table.

Orders

key

Map

Required. The primary key of the item to update, in low-level AttributeValue format.

{"orderId": {"S": "123"}}

awsRoleArn

String

Optional. IAM role ARN to assume for AWS API calls.

arn:aws:iam::123456789012:role/my-workflow-role

awsAccessKeyId

String

Optional. AWS access key ID. Pass as a secret.

${{ :secrets:awsAccessKeyId }}

awsSecretAccessKey

String

Optional. AWS secret access key. Pass as a secret.

${{ :secrets:awsSecretAccessKey }}

awsSessionToken

String

Optional. Temporary session token for STS authentication. Pass as a secret.

${{ :secrets:awsSessionToken }}

updateExpression

String

Optional. Defines attributes to update. Supports SET, REMOVE, ADD, and DELETE actions.

SET #s = :status

conditionExpression

String

Optional. A condition that must be satisfied for the UpdateItem to succeed.

attribute_exists(orderId)

expressionAttributeNames

Map

Optional. Substitution tokens for attribute names in expressions. Use #name syntax to reference reserved words or special characters.

{"#s": "status"}

expressionAttributeValues

Map

Optional. Substitution values for expressions in low-level AttributeValue format.

{":status": {"S": "SHIPPED"}}

parameters

Map

Optional. Passthrough for any update_item field not modeled above. Common value: ReturnValues (NONE default | ALL_OLD | UPDATED_OLD | ALL_NEW | UPDATED_NEW). See the UpdateItem API reference.

{"ReturnValues": "UPDATED_NEW"}

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "attributes", "expression": ".response.Attributes"}]

The following table describes the output fields for this action.

Output

Type

Example

success

Boolean

true or false

response

Object

Contains Attributes if ReturnValues is set via parameters. See the UpdateItem API reference.

errorMessage

String

Error message on failure.

Example

name: update-dynamodb-item
description: Update the status of an order in DynamoDB
steps:
- name: updateOrderStatus
type: action
action: aws.dynamodb.updateItem
version: '1'
inputs:
awsRoleArn: ${{ :secrets:awsRoleArn }}
region: us-east-2
tableName: Orders
key:
orderId: { "S": "123" }
updateExpression: 'SET #s = :status'
expressionAttributeNames:
'#s': status
expressionAttributeValues:
':status': { "S": "SHIPPED" }
parameters:
ReturnValues: UPDATED_NEW
selectors:
- name: attributes
expression: '.response.Attributes'
next: end

Delete an item

The action identifier is aws.dynamodb.deleteItem.

Deletes a single item from a DynamoDB table by its primary key.

The following table describes the input fields for this action.

Input

Type

Description

Example

region

String

Required. AWS region of the target table.

us-east-2

tableName

String

Required. Name of the DynamoDB table.

Orders

key

Map

Required. The primary key of the item to delete, in low-level AttributeValue format.

{"orderId": {"S": "123"}}

awsRoleArn

String

Optional. IAM role ARN to assume for AWS API calls.

arn:aws:iam::123456789012:role/my-workflow-role

awsAccessKeyId

String

Optional. AWS access key ID. Pass as a secret.

${{ :secrets:awsAccessKeyId }}

awsSecretAccessKey

String

Optional. AWS secret access key. Pass as a secret.

${{ :secrets:awsSecretAccessKey }}

awsSessionToken

String

Optional. Temporary session token for STS authentication. Pass as a secret.

${{ :secrets:awsSessionToken }}

conditionExpression

String

Optional. A condition that must be satisfied for the DeleteItem to succeed.

attribute_exists(orderId)

expressionAttributeNames

Map

Optional. Substitution tokens for attribute names in expressions.

{"#n": "name"}

expressionAttributeValues

Map

Optional. Substitution values for expressions in low-level AttributeValue format.

{":id": {"S": "123"}}

parameters

Map

Optional. Passthrough for any delete_item field not modeled above. Common value: ReturnValues (NONE default | ALL_OLD). See the DeleteItem API reference.

{"ReturnValues": "ALL_OLD"}

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "attributes", "expression": ".response.Attributes"}]

The following table describes the output fields for this action.

Output

Type

Example

success

Boolean

true or false

response

Object

Contains Attributes if ReturnValues is set via parameters. See the DeleteItem API reference.

errorMessage

String

Error message on failure.

Example

name: delete-dynamodb-item
description: Delete an order item from DynamoDB
steps:
- name: deleteOrderItem
type: action
action: aws.dynamodb.deleteItem
version: '1'
inputs:
awsRoleArn: ${{ :secrets:awsRoleArn }}
region: us-east-2
tableName: Orders
key:
orderId: { "S": "123" }
next: end

Scan a table

The action identifier is aws.dynamodb.scan.

Returns items from a DynamoDB table or index by scanning the entire table, with optional filtering. A single scan response is limited to 100 KB by Workflow Automation (DynamoDB's own limit is 1 MB). Use limit and exclusiveStartKey to paginate through large tables.

Importante

Workflow Automation enforces a 100 KB output size limit per action. aws.dynamodb.scan throws an output size limit exceeded exception when the response exceeds this limit, even though it may be within DynamoDB's own 1 MB per-response cap. Use limit and exclusiveStartKey to paginate results and stay within this limit.

The following table describes the input fields for this action.

Input

Type

Description

Example

region

String

Required. AWS region of the target table.

us-east-2

tableName

String

Required. Name of the DynamoDB table.

Orders

awsRoleArn

String

Optional. IAM role ARN to assume for AWS API calls.

arn:aws:iam::123456789012:role/my-workflow-role

awsAccessKeyId

String

Optional. AWS access key ID. Pass as a secret.

${{ :secrets:awsAccessKeyId }}

awsSecretAccessKey

String

Optional. AWS secret access key. Pass as a secret.

${{ :secrets:awsSecretAccessKey }}

awsSessionToken

String

Optional. Temporary session token for STS authentication. Pass as a secret.

${{ :secrets:awsSessionToken }}

indexName

String

Optional. Name of a local or global secondary index to scan instead of the base table.

my-gsi

filterExpression

String

Optional. A condition applied after items are read. Filtered items are not returned but still consume read capacity.

#s = :status

projectionExpression

String

Optional. Comma-separated list of attributes to retrieve. If omitted, all attributes are returned.

id, #n

expressionAttributeNames

Map

Optional. Substitution tokens for attribute names in expressions.

{"#s": "status"}

expressionAttributeValues

Map

Optional. Substitution values for expressions in low-level AttributeValue format.

{":status": {"S": "ACTIVE"}}

select

String

Optional. Attributes to return. Allowed values: ALL_ATTRIBUTES, ALL_PROJECTED_ATTRIBUTES, SPECIFIC_ATTRIBUTES, COUNT.

ALL_ATTRIBUTES

limit

Integer

Optional. Maximum number of items to evaluate (not necessarily items returned). Minimum: 1.

100

consistentRead

Boolean

Optional. If true, uses strongly consistent reads. Not supported on global secondary indexes. Default: false.

false

exclusiveStartKey

Map

Optional. Primary key of the first item to evaluate. Use the LastEvaluatedKey from a previous scan to paginate.

{"orderId": {"S": "123"}}

totalSegments

Integer

Optional. Total number of segments for a parallel scan. Must be used with segment. Allowed range: 1–1,000,000.

4

segment

Integer

Optional. Zero-based segment ID for a parallel scan. Must be used with totalSegments.

0

parameters

Map

Optional. Passthrough for any scan field not modeled above. See the Scan API reference.

{"ReturnConsumedCapacity": "TOTAL"}

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "items", "expression": ".response.Items"}]

The following table describes the output fields for this action.

Output

Type

Example

success

Boolean

true or false

response

Object

Contains Items (matched items) and LastEvaluatedKey (present when more pages exist). See the Scan API reference.

errorMessage

String

Error message on failure.

Example

name: scan-dynamodb-table
description: Scan for active orders in DynamoDB
steps:
- name: scanActiveOrders
type: action
action: aws.dynamodb.scan
version: '1'
inputs:
awsRoleArn: ${{ :secrets:awsRoleArn }}
region: us-east-2
tableName: Orders
filterExpression: '#s = :status'
expressionAttributeNames:
'#s': status
expressionAttributeValues:
':status': { "S": "ACTIVE" }
limit: 50
selectors:
- name: items
expression: '.response.Items'
- name: lastKey
expression: '.response.LastEvaluatedKey'
next: end

Query a table

The action identifier is aws.dynamodb.query.

Returns items from a DynamoDB table or index that match a partition key, optionally narrowed by a sort-key condition or filter expression. More efficient than scan for key-based lookups.

Importante

Workflow Automation enforces a 100 KB output size limit per action. aws.dynamodb.query throws an output size limit exceeded exception when the response exceeds this limit, even though it may be within DynamoDB's own 1 MB per-response cap. Use limit and exclusiveStartKey to paginate results and stay within this limit.

The following table describes the input fields for this action.

Input

Type

Description

Example

region

String

Required. AWS region of the target table.

us-east-2

tableName

String

Required. Name of the DynamoDB table.

Orders

awsRoleArn

String

Optional. IAM role ARN to assume for AWS API calls.

arn:aws:iam::123456789012:role/my-workflow-role

awsAccessKeyId

String

Optional. AWS access key ID. Pass as a secret.

${{ :secrets:awsAccessKeyId }}

awsSecretAccessKey

String

Optional. AWS secret access key. Pass as a secret.

${{ :secrets:awsSecretAccessKey }}

awsSessionToken

String

Optional. Temporary session token for STS authentication. Pass as a secret.

${{ :secrets:awsSessionToken }}

indexName

String

Optional. Name of a local or global secondary index to query.

customerId-index

keyConditionExpression

String

Optional. Condition on the partition key (required) and optionally the sort key.

customerId = :cid

filterExpression

String

Optional. A condition applied after items are read. Cannot reference key attributes. Filtered items are not returned but still consume read capacity.

#s = :status

projectionExpression

String

Optional. Comma-separated list of attributes to retrieve.

id, #n

expressionAttributeNames

Map

Optional. Substitution tokens for attribute names in expressions.

{"#s": "status"}

expressionAttributeValues

Map

Optional. Substitution values for expressions in low-level AttributeValue format.

{":cid": {"S": "cust-1"}}

select

String

Optional. Attributes to return. Allowed values: ALL_ATTRIBUTES, ALL_PROJECTED_ATTRIBUTES, SPECIFIC_ATTRIBUTES, COUNT.

ALL_ATTRIBUTES

limit

Integer

Optional. Maximum number of items to evaluate. Minimum: 1.

100

scanIndexForward

Boolean

Optional. If true (default), returns results in ascending sort-key order. If false, returns in descending order.

true

consistentRead

Boolean

Optional. If true, uses strongly consistent reads. Not supported on global secondary indexes. Default: false.

false

exclusiveStartKey

Map

Optional. Primary key of the first item to evaluate. Use the LastEvaluatedKey from a previous query to paginate.

{"orderId": {"S": "123"}}

parameters

Map

Optional. Passthrough for any query field not modeled above. See the Query API reference.

{"ReturnConsumedCapacity": "TOTAL"}

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "items", "expression": ".response.Items"}]

The following table describes the output fields for this action.

Output

Type

Example

success

Boolean

true or false

response

Object

Contains Items (matched items) and LastEvaluatedKey (present when more pages exist). See the Query API reference.

errorMessage

String

Error message on failure.

Example

name: query-dynamodb-table
description: Query orders by customer ID
steps:
- name: queryCustomerOrders
type: action
action: aws.dynamodb.query
version: '1'
inputs:
awsRoleArn: ${{ :secrets:awsRoleArn }}
region: us-east-2
tableName: Orders
indexName: customerId-index
keyConditionExpression: 'customerId = :cid'
expressionAttributeValues:
':cid': { "S": "cust-1" }
selectors:
- name: items
expression: '.response.Items'
next: end

Describe a table

The action identifier is aws.dynamodb.describeTable.

Returns table information including status, primary key schema, provisioned throughput, and (for global tables) replica status.

The following table describes the input fields for this action.

Input

Type

Description

Example

region

String

Required. AWS region of the target table.

us-east-2

tableName

String

Required. Name of the DynamoDB table.

Orders

awsRoleArn

String

Optional. IAM role ARN to assume for AWS API calls.

arn:aws:iam::123456789012:role/my-workflow-role

awsAccessKeyId

String

Optional. AWS access key ID. Pass as a secret.

${{ :secrets:awsAccessKeyId }}

awsSecretAccessKey

String

Optional. AWS secret access key. Pass as a secret.

${{ :secrets:awsSecretAccessKey }}

awsSessionToken

String

Optional. Temporary session token for STS authentication. Pass as a secret.

${{ :secrets:awsSessionToken }}

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "tableStatus", "expression": ".response.Table.TableStatus"}]

The following table describes the output fields for this action.

Output

Type

Example

success

Boolean

true or false

response

Object

Contains Table with TableStatus, KeySchema, ProvisionedThroughput, and Replicas for global tables. See the DescribeTable API reference.

errorMessage

String

Error message on failure.

Example

name: describe-dynamodb-table
description: Get the status and configuration of a DynamoDB table
steps:
- name: describeOrdersTable
type: action
action: aws.dynamodb.describeTable
version: '1'
inputs:
awsRoleArn: ${{ :secrets:awsRoleArn }}
region: us-east-2
tableName: Orders
selectors:
- name: tableStatus
expression: '.response.Table.TableStatus'
next: end

List tables

The action identifier is aws.dynamodb.listTables.

Returns a list of DynamoDB table names in the current AWS account and region. Results are paginated — use exclusiveStartTableName with the LastEvaluatedTableName from a previous response to page through results.

The following table describes the input fields for this action.

Input

Type

Description

Example

region

String

Required. AWS region to list tables in.

us-east-2

awsRoleArn

String

Optional. IAM role ARN to assume for AWS API calls.

arn:aws:iam::123456789012:role/my-workflow-role

awsAccessKeyId

String

Optional. AWS access key ID. Pass as a secret.

${{ :secrets:awsAccessKeyId }}

awsSecretAccessKey

String

Optional. AWS secret access key. Pass as a secret.

${{ :secrets:awsSecretAccessKey }}

awsSessionToken

String

Optional. Temporary session token for STS authentication. Pass as a secret.

${{ :secrets:awsSessionToken }}

exclusiveStartTableName

String

Optional. First table name to evaluate. Use the LastEvaluatedTableName from a previous response to paginate.

my-table

limit

Integer

Optional. Maximum number of table names to return (1–100). Default: 100.

50

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "tableNames", "expression": ".response.TableNames"}]

The following table describes the output fields for this action.

Output

Type

Example

success

Boolean

true or false

response

Object

Contains TableNames (list of table name strings) and LastEvaluatedTableName when more pages exist. See the ListTables API reference.

errorMessage

String

Error message on failure.

Example

name: list-dynamodb-tables
description: List all DynamoDB tables in a region
steps:
- name: listDynamoTables
type: action
action: aws.dynamodb.listTables
version: '1'
inputs:
awsRoleArn: ${{ :secrets:awsRoleArn }}
region: us-east-2
selectors:
- name: tableNames
expression: '.response.TableNames'
next: end

Update a table

The action identifier is aws.dynamodb.updateTable.

Modifies the provisioned throughput settings, billing mode, global secondary indexes, replication regions, or other settings of a DynamoDB table.

The following table describes the input fields for this action.

Input

Type

Description

Example

region

String

Required. AWS region of the target table.

us-east-2

tableName

String

Required. Name of the DynamoDB table.

Orders

awsRoleArn

String

Optional. IAM role ARN to assume for AWS API calls.

arn:aws:iam::123456789012:role/my-workflow-role

awsAccessKeyId

String

Optional. AWS access key ID. Pass as a secret.

${{ :secrets:awsAccessKeyId }}

awsSecretAccessKey

String

Optional. AWS secret access key. Pass as a secret.

${{ :secrets:awsSecretAccessKey }}

awsSessionToken

String

Optional. Temporary session token for STS authentication. Pass as a secret.

${{ :secrets:awsSessionToken }}

attributeDefinitions

List

Optional. Array of attribute definitions for the table and indexes. Required when adding a new global secondary index.

[{"AttributeName": "id", "AttributeType": "S"}]

billingMode

String

Optional. Controls how throughput is charged. Allowed values: PROVISIONED, PAY_PER_REQUEST.

PAY_PER_REQUEST

provisionedThroughput

Map

Optional. Required when billingMode is PROVISIONED. Cannot be set when billingMode is PAY_PER_REQUEST.

{"ReadCapacityUnits": 5, "WriteCapacityUnits": 5}

globalSecondaryIndexUpdates

List

Optional. One or more global secondary index update actions (create, update, or delete). Maximum 20 GSIs per table.

[{"Update": {"IndexName": "my-gsi", "ProvisionedThroughput": {"ReadCapacityUnits": 5, "WriteCapacityUnits": 5}}}]

streamSpecification

Map

Optional. Settings for DynamoDB Streams.

{"StreamEnabled": true, "StreamViewType": "NEW_AND_OLD_IMAGES"}

sseSpecification

Map

Optional. Server-side encryption settings.

{"Enabled": true, "SSEType": "KMS"}

deletionProtectionEnabled

Boolean

Optional. Enable or disable deletion protection on the table.

true

parameters

Map

Optional. Passthrough for any update_table field not modeled above. Common values: ReplicaUpdates (add/remove global table replicas), TableClass (STANDARD | STANDARD_INFREQUENT_ACCESS). See the UpdateTable API reference.

{"ReplicaUpdates": [{"Create": {"RegionName": "eu-west-1"}}]}

selectors

List

Optional. JQ selectors to extract specific fields from the action output.

[{"name": "tableStatus", "expression": ".response.TableDescription.TableStatus"}]

The following table describes the output fields for this action.

Output

Type

Example

success

Boolean

true or false

response

Object

Contains TableDescription. See the UpdateTable API reference.

errorMessage

String

Error message on failure.

Example

name: update-dynamodb-table
description: Switch a DynamoDB table to on-demand billing
steps:
- name: setPayPerRequest
type: action
action: aws.dynamodb.updateTable
version: '1'
inputs:
awsRoleArn: ${{ :secrets:awsRoleArn }}
region: us-east-2
tableName: Orders
billingMode: PAY_PER_REQUEST
selectors:
- name: tableStatus
expression: '.response.TableDescription.TableStatus'
next: end
Copyright © 2026 New Relic Inc.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.