Amazon DynamoDB is a fully managed NoSQL database service provided by AWS that offers seamless scalability and high performance. It’s designed for applications that need consistent, single-digit millisecond performance at any scale, making it ideal for mobile, web, gaming, and IoT applications. By connecting DynamoDB to your Nekt catalog, you can centralize your NoSQL data alongside other data sources, enabling comprehensive analysis and data integration across your organization. This guide will walk you through the process of setting up DynamoDB as a data source, including the necessary AWS permissions configuration and connection settings. It’s important to note we support incremental sync for this source, making the whole process more efficient. For that to work, you need to have a valid replication key in your documents (either a date or timestamp field).

Configuring DynamoDB as a Source

In the Sources tab, click on the “Add source” button located on the top right of your screen. Then, select the DynamoDB option from the list of connectors. Click Next and you’ll be prompted to add your access.

1. Add account access

You need to define some permissions to allow Nekt to access your DynamoDB tables. Check the instructions below:

Setting permissions

Create role and add custom policy

Open the AWS Console using the account that hosts the DynamoDB table you’d like to extract data from.
Enter the IAM (Identity and Access Management) service page.
In the left panel under Access management, select Roles.
Click Create role.
In Trusted entity type, select Custom trust policy.
Change the Principal value to:

{
    "AWS": "arn:aws:iam::{AWS_ACCOUNT_ID}:role/nekt-ecs-task-role"
}

The variable must be replaced by the ID of the AWS account where the Nekt workspace is deployed. In order to find this information, click the dropdown in the top-right corner of the AWS console page after you log in with your account, then click on the “copy” icon to the right of your Account ID.

Check the full trust policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::{AWS_ACCOUNT_ID}:role/nekt-ecs-task-role"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Click Next.
Click Next again without adding any permission. We’ll create an inline policy further on.
Under Role details, you can type any Role name as you want. Example: nekt-dynamodb-source.
Optionally, type a Description. Example: Used by Nekt to extract data from DynamoDB.
Click Create role .

You should get redirected back to the IAM roles page and a message of success should appear at the top.Add permissions to role

Open the role you just created by clicking View role in the right end of the green banner that appeared at the top of the page. If you dismissed it already, you can type the given Role name in the search field and then select it when it appears in the list.
Within Permission policies (0), click the Add permissions.
Select Create inline policy.
Within Policy editor, select JSON.
Paste the following policy in the Policy editor:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "dynamodb:BatchGetItem",
                "dynamodb:ConditionCheckItem",
                "dynamodb:DescribeContributorInsights",
                "dynamodb:Scan",
                "dynamodb:ListTagsOfResource",
                "dynamodb:Query",
                "dynamodb:DescribeTimeToLive",
                "dynamodb:PartiQLSelect",
                "dynamodb:DescribeTable",
                "dynamodb:GetItem",
                "dynamodb:DescribeContinuousBackups",
                "dynamodb:DescribeKinesisStreamingDestination",
                "dynamodb:DescribeTableReplicaAutoScaling"
            ],
            "Resource": "{DYNAMO_DB_ARN}"
        }
    ]
}

Replace the {DYNAMO_DB_ARN} part with the ARN of the DynamoDB table which you’d like to extract data from.
- If you don’t know it, open a new tab in your browser and enter the DynamoDB service page.
- In the left panel, click Tables.
- Open the desired table by clicking on its name in the list.
- Under General information, click Additional info.
- Click the “copy” icon just below Amazon Resource Name (ARN). A tool tip should appear containing the message ARN copied.
- Go back to the IAM policy editor that you left open in the previous tab and paste the ARN you just copied over {DYNAMO_DB_ARN}.

Full role policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "dynamodb:BatchGetItem",
                "dynamodb:ConditionCheckItem",
                "dynamodb:DescribeContributorInsights",
                "dynamodb:Scan",
                "dynamodb:ListTagsOfResource",
                "dynamodb:Query",
                "dynamodb:DescribeTimeToLive",
                "dynamodb:PartiQLSelect",
                "dynamodb:DescribeTable",
                "dynamodb:GetItem",
                "dynamodb:DescribeContinuousBackups",
                "dynamodb:DescribeKinesisStreamingDestination",
                "dynamodb:DescribeTableReplicaAutoScaling"
            ],
            "Resource": "arn:aws:dynamodb:{AWS_REGION}:{AWS_ACCOUNT_ID}:table/{TABLE_NAME}"
        }
    ]
}

Click Next.
Under Policy details type any Policy name as you want. Example: nekt-dynamodb-source-policy.
Click Create policy.

You should get redirected back to the role you just created and a message of success should appear at the top.

When setting up the connector at Nekt, you will use the ARN of the role you’ve just created.

The following configurations are available:

Table names: Provide the name of the tables you want to extract. Write them exactly as you see in your Dynamo DB.
Assume role ARN (AWS): The ARN role you’ve just created in the permissions setup step.
Infer schema sample size: Defines how many records you want to use to infer your table’s schema. The more consistent your schema is, the smaller your sample can be.

Once you’re done, click Next.

2. Select streams

Choose which data streams you want to sync. For DynamoDB, these correspond to the tables you configured in the previous step.

Tip: The stream can be found more easily by typing its name.

Select the streams and click Next.

3. Configure data streams

Customize how you want your data to appear in your catalog. Select the desired layer where the data will be placed, a folder to organize it inside the layer, a name for each table (which will effectively contain the fetched data) and the type of sync.

Layer: choose between the existing layers on your catalog. This is where you will find your new extracted tables as the extraction runs successfully.
Folder: a folder can be created inside the selected layer to group all tables being created from this new data source.
Table name: we suggest a name, but feel free to customize it. You have the option to add a prefix to all tables at once and make this process faster!
Sync Type: you can choose between INCREMENTAL and FULL_TABLE.
- Incremental: every time the extraction happens, we’ll get only the new data - which is good if, for example, you want to keep every record ever fetched.
- Full table: every time the extraction happens, we’ll get the current state of the data - which is good if, for example, you don’t want to have deleted data in your catalog.

If you define INCREMENTAL as the sync type for your table, you will have to add an incremental key. Incremental keys must be of integer or string types, as long as they’re formatted as ISO8601 dates. To ensure consistency between extractions, make sure the field you select represents the last modification date of a document.

Once you are done configuring, click Next.

4. Configure data source

Describe your data source for easy identification within your organization, not exceeding 140 characters. To define your Trigger, consider how often you want data to be extracted from this source. This decision usually depends on how frequently you need the new table data updated (every day, once a week, or only at specific times). Optionally, you can define some additional settings:

Configure Delta Log Retention and determine for how long we should store old states of this table as it gets updated. Read more about this resource here.
Determine when to execute an Additional Full Sync. This will complement the incremental data extractions, ensuring that your data is completely synchronized with your source every once in a while.

Once you are ready, click Next to finalize the setup.

5. Check your new source

You can view your new source on the Sources page. If needed, manually trigger the source extraction by clicking on the arrow button. Once executed, your data will appear in your Catalog.

For you to be able to see it on your Catalog, you need at least one successful source run.

Streams and Fields

The DynamoDB connector dynamically exposes streams corresponding to your selected tables. The data is returned with a standardized schema, serializing the NoSQL document into a manageable format.

DynamoDB Tables

Stream representing items from your DynamoDB tables.Key fields:

Field	Type	Description
`_hash_id`	String	Unique identifier for the item, generated by hashing the primary keys of the DynamoDB record.
`document`	String	A JSON string containing the full serialized DynamoDB item.

Serialization Notes:The entire DynamoDB item is flattened into a single JSON string within the document field. During this process, specific native data types are serialized to ensure proper formatting downstream:

Decimals: Automatically converted to standard numeric formats (int or float).
Dates/Timestamps: Serialized to ISO 8601 standard strings.
Sets: Converted to standard JSON Arrays (lists).
Bytes: Decoded into UTF-8 strings.

Transformation example: extracting fields from the document

The document column stores all event attributes as a single JSON string. To analyze specific properties in Explorer or downstream models, you can parse the JSON and expose the keys as separate columns.

SQL transformation (AWS Athena / GCP BigQuery)

AWS (Athena)
GCP (BigQuery)

SELECT
   _hash_id,
   json_extract_scalar(document, '$.item_name') AS item_name,
   json_extract_scalar(document, '$.status') AS status,
   CAST(json_extract_scalar(document, '$.price') AS DOUBLE) AS price
FROM
   nekt_raw.dynamodb_your_table

Replace nekt_raw.dynamodb_your_table with your actual layer and table name. Use json_extract_scalar() for string properties; for numeric properties use CAST(json_extract_scalar(document, '$.key') AS DOUBLE).

SELECT
   _hash_id,
   JSON_VALUE(document, '$.item_name') AS item_name,
   JSON_VALUE(document, '$.status') AS status,
   SAFE_CAST(JSON_VALUE(document, '$.price') AS FLOAT64) AS price
FROM
   `nekt_raw.dynamodb_your_table`

Replace nekt_raw.dynamodb_your_table with your actual dataset and table name. Use JSON_VALUE() for string properties; for numeric properties use SAFE_CAST(JSON_VALUE(document, '$.key') AS FLOAT64).

Skills for agents

Download DynamoDB skills file

DynamoDB connector documentation as plain markdown, for use in AI agent contexts.

​Configuring DynamoDB as a Source

​1. Add account access

​2. Select streams

​3. Configure data streams

​4. Configure data source

​5. Check your new source

​Streams and Fields

​Transformation example: extracting fields from the document

​Skills for agents

Download DynamoDB skills file

Configuring DynamoDB as a Source

1. Add account access

2. Select streams

3. Configure data streams

4. Configure data source

5. Check your new source

Streams and Fields

Transformation example: extracting fields from the document

Skills for agents