Skippr Docs

Appearance

What Access Skippr Needs to Read from DynamoDB ​

June 2026

DynamoDB access has a clean split between table reads and stream reads, and Skippr needs you to decide which one you are granting.

Short Answer ​

Skippr needs an AWS principal that can call dynamodb:DescribeTable and dynamodb:Scan on the target table for batch reads. If you enable CDC, the access model expands to DynamoDB Streams: the table must have Streams enabled with NEW_AND_OLD_IMAGES, and the principal also needs dynamodb:DescribeStream, dynamodb:GetShardIterator, and dynamodb:GetRecords.

A good example is a table named orders in us-east-1. A role with scan access can establish the first extract and prove the item shape, while a later CDC rollout adds stream permissions so Skippr can consume INSERT, MODIFY, and REMOVE records with full before and after item state.

Why Teams Struggle with This ​

DynamoDB trips teams up because partial success looks close to full success. A role can scan a table and still be completely unready for CDC, or it can have stream permissions while the table was never configured with the stream view type that preserves enough item detail.

  • Batch extraction needs dynamodb:DescribeTable and dynamodb:Scan before anything else matters.
  • CDC needs DynamoDB Streams enabled with StreamViewType = NEW_AND_OLD_IMAGES, not a weaker stream view.
  • The stream reader permissions are separate: DescribeStream, GetShardIterator, and GetRecords do not come from normal table read access.
  • Region mismatches are easy to miss because the same table name may exist elsewhere or appear missing for reasons that look like IAM.

How Skippr Handles It ​

Skippr makes the split access model visible instead of hiding it behind a general AWS connection. The source config is just table name, region, and optional endpoint, while the CDC guide separately documents the extra Streams permissions and stream configuration needed for real-time capture.

That matters operationally because restart behavior also depends on stream access. Skippr stores the last processed sequence number per shard and resumes from it, which only works if the IAM role can keep reading shard iterators over time.

  • Uses the AWS default credential chain rather than a custom auth surface.
  • Requires DescribeTable and Scan for normal batch extraction.
  • Adds DynamoDB Streams permissions and stream prerequisites when cdc_enabled: true is set.
  • Resumes CDC from stored shard sequence numbers after committed batches.

What the First Useful Version Looks Like ​

The first useful version is one table, one AWS region, and one role that can scan it cleanly so you can verify keys, item shape, and row volume.

Only add Streams after that baseline is clear, because CDC is a stronger contract that depends on both IAM and the table stream configuration being right.