What Network Access Skippr Needs for DynamoDB

June 2026

DynamoDB source access is an AWS API and IAM problem first: the runner needs the right table, region, and permissions for scans, then Streams if CDC is enabled.

Short Answer

Skippr needs AWS access to the DynamoDB table in the configured region, plus the exact permissions required for the mode you are using. The docs make the baseline clear: batch reads need dynamodb:DescribeTable and dynamodb:Scan, while CDC also needs DynamoDB Streams permissions. In practice, the reachable boundary is the regional DynamoDB API together with an AWS principal that can read the table you named.

That changes how you validate the source. If the table is orders in us-east-1, it is not enough that the runner has some AWS credentials. Those credentials must resolve in us-east-1, describe the table, and scan it. If you later enable cdc_enabled: true, the path expands to include the table stream as well, which is a different permission surface even though the source name stays the same.

Why Teams Struggle with This

DynamoDB is often described as a simple connector because the config is small, but the real boundary lives in IAM and region placement. Teams discover that only after a role can authenticate to AWS and still cannot read the table or its stream.

• Batch reads require dynamodb:DescribeTable and dynamodb:Scan, not just generic AWS credentials.
• CDC adds DynamoDB Streams permissions on top of normal table-read access.
• The region must match the real table location or the connector will look empty or unauthorized.
• A custom endpoint such as LocalStack is a separate access path and should not be confused with production AWS.

How Skippr Handles It

Skippr keeps the DynamoDB boundary clean by asking for table_name, region, and optional endpoint_url, then relying on the AWS default credential chain. That makes the network story concrete: one runner, one region, one table, one AWS identity.

It also gives you a sensible rollout path. You can prove access with a batch scan first, then turn on CDC only after the stream permissions and destination semantics are ready, which is much easier than debugging table access and stream access at the same time.

• Uses the AWS default credential chain instead of a custom auth layer.
• Targets one table and one region explicitly.
• Separates batch-read prerequisites from Streams-based CDC prerequisites.
• Works with a custom endpoint for local testing when that is the intended environment.

What the First Useful Version Looks Like

The first useful version is one table, one region, and one small batch extract that proves the item shape and IAM policy are correct.

Only add Streams after that batch path is clean. If the table is not readable yet, the stream path will only add more moving parts.