You need the access key and secret access key from your Amazon DynamoDB account to allow Hevo to access the data from it.

1. Log in to the AWS Console, and search and select the IAM service.

2. In the left navigation bar, under Access management, click Users, and then, in the right pane, click the User name for which you want to create an access key.

   

3. On the Summary page, click the Security credentials tab, and then, click Create access key.

   

4. On the Access key best practices & alternatives page, do the following:

   

   1. Select one of the following recommended methods. For example, in the image below, Command Line Interface (CLI) is selected.

   2. Select the I understand the above recommendation… check box, to proceed with creating the access key.

   3. Click Next.

5. On the Set description tag - optional page, do the following:

   

   1. (Optional) Specify a description for the access key in the Description tag value field.

   2. Click Create access key.

6. On the Retrieve access keys page, do the following:

   

   • Click the copy icon in the Access key field and save the key securely like any other password.

   • Click the copy icon in the Secret access key field and save the key securely like any other password.

     Note: Once you exit this page, you cannot view these keys again.

   • (Optional) Click Download .csv file to save the access key and the secret access key on your local machine.

To generate your IAM role-based credentials, you need to:

1. Create an IAM policy with the permission to allow Hevo to access data from your DynamoDB database.

2. Create an IAM role for Hevo, as the Amazon Resource Name (ARN) and the external ID from this role are required to configure Amazon DynamoDB as a Source in Hevo.

These steps are explained in details below:

1. Create an IAM policy

1. Log in to the AWS IAM Console.

2. In the left navigation bar, under Access management, click Policies.

   

3. On the Policies page, click Create policy.

   

4. On the Specify permissions page, click the JSON tab and paste the following policy in the editor. The JSON statements list the permissions the policy would assign to Hevo.

   Note:

   • Replace the placeholder values in the commands below with your own. For example, <aws_region> with us-east-1.

   • You can replace the <table_name> in the command below with * to ingest data from all the tables in your database.

      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
             "dynamodb:Scan",
             "dynamodb:GetRecords",
             "dynamodb:ListTables",
             "dynamodb:ListStreams",
             "dynamodb:DescribeTable",
             "dynamodb:DescribeStream",
             "dynamodb:GetShardIterator"
            ],
            "Resource": [ "arn:aws:dynamodb:<aws_region>:<aws_account_no>:role/<table_name>"
            ]
          }
        ]
     }
   
   

   Note: Hevo does not modify any data in the Source tables. The permissions are used solely to store the last processed state for a table by the KCL.

   

5. Click Next.

6. On the Review and create page, specify a Policy name and Description for your policy and click Create policy.

   

You are redirected to the Policies page, where you can see the policy that you created.

2. Create an IAM role and obtain its ARN and External ID

Perform the following steps to create an IAM role:

1. Log in to the AWS IAM Console.

2. In the left navigation bar, under Access management, click Roles.

   

3. On the Roles page, click Create role.

   

4. On the Select trusted entity page:

   • In the Trusted entity type section, select AWS account.

     

   • In the An AWS account section, do the following:

     

     1. Select the Another AWS account option, and specify Hevo’s Account ID, 393309748692.

     2. In the Options section, select the Require external ID… check box, and specify an External ID of your choice.

        Note: You must save this external ID in a secure location like any other password. This is required while setting up a Pipeline in Hevo.

5. Click Next.

6. In the Permissions policies section, select the policy that you created in the create an IAM policy section above and click Next at the bottom of the page.

   

7. On the Name, review, and create page, specify the Role name and Description and click Create role.

   

8. On the Roles page, click the role that you created above.

   

9. On the <Role name> page, the Summary section, click the copy icon to copy the ARN and save it securely like any other password. Use this ARN while configuring Amazon DynamoDB as a Source in Hevo.