DynamoDB
Specify the following to connect to data:
Domain: Set this if you want to use a domain name you have associated with AWS.
AWSRegion: Set this to the region where your Amazon DynamoDB data is hosted.
1 Authenticating to DynamoDB
1.1 Obtaining the Access Key
To obtain the credentials for an IAM user, follow the steps below:
Sign into the IAM console.
In the navigation pane, select Users.
To create or manage the access keys for a user, select the user and then select the Security Credentials tab.
To obtain the credentials for your AWS root account, follow the steps below:
Sign into the AWS Management console with the credentials for your root account.
Select your account name or number and select My Security Credentials in the menu that is displayed.
Click Continue to Security Credentials and expand the Access Keys section to manage or create root account access keys.
1.2 Authenticating with Root Credentials
To authenticate using account root credentials, set the following:
AuthScheme: Set this to AwsRootKeys.
AWSAccessKey: The access key associated with the AWS root account.
AWSSecretKey: The secret key associated with the AWS root account.
Note: Use of this authentication scheme is discouraged by Amazon for anything but simple tests. The account root credentials have the full permissions of the user, making this the least secure authentication method.
1.3 Authenticating with Temporary Credentials
To authenticate using temporary credentials, specify the following:
AuthScheme: Set this to TemporaryCredentials.
AWSAccessKey: The access key of the IAM user to assume the role for.
AWSSecretKey: The secret key of the IAM user to assume the role for.
AWSSessionToken: Your AWS session token. This will have been provided alongside your temporary credentials. See this link for more info.
The provider can now request resources using the same permissions provided by long-term credentials (such as IAM user credentials) for the lifespan of the temporary credentials.
If you are also using an IAM role to authenticate, you must additionally specify the following:
AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the provider to attempt to retrieve credentials for the specified role.
AWSExternalId: Only if required when you assume a role in another account.
1.4 Authenticating from an EC2 Instance
If you are using the provider from an EC2 Instance and have an IAM Role assigned to the instance, you can use the IAM Role to authenticate. To do so, set the following properties to authenticate:
AuthScheme: Set this to AwsEC2Roles.
Do not specify AWSAccessKey and AWSSecretKey because the provider will automatically obtain your IAM Role credentials and authenticate with them.
If you are also using an IAM role to authenticate, you must additionally specify the following:
AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the provider to attempt to retrieve credentials for the specified role.
AWSExternalId: Only if required when you assume a role in another account.
1.5 Authenticating as an AWS Role
In many situations it may be preferable to use an IAM role for authentication instead of the direct security credentials of an AWS root user.
To authenticate as an AWS role, set the following:
AuthScheme: Set this to AwsIAMRoles.
AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the provider to attempt to retrieve credentials for the specified role.
AWSExternalId: Only if required when you assume a role in another account.
AWSAccessKey: The access key of the IAM user to assume the role for.
AWSSecretKey: The secret key of the IAM user to assume the role for.
Note: Roles may not be used when specifying the AWSAccessKey and AWSSecretKey of an AWS root user.
1.6 Authenticating with ADFS
Set the AuthScheme to ADFS. The following connection properties need to be set:
User: Set this to the ADFS user.
Password: Set this to ADFS password for the user.
SSOLoginUrl: Set this to the login url used by the SSO provider.
1.7 ADFS Integrated
The ADFS Integrated flow indicates you are connecting with the currently logged in Windows user credentials. To use the ADFS Integrated flow, simply do not specify the User and Password, but otherwise follow the same steps in the ADFS guide above.
1.8 Authenticating with Okta
Set the AuthScheme to Okta. The following connection properties are used to connect to Okta:
User: Set this to the Okta user.
Password: Set this to Okta password for the user.
SSOLoginUrl: Set this to the login url used by the SSO provider.
The following SSOProperties are needed to authenticate to Okta:
APIToken (optional): Set this to the API Token that the customer created from the Okta org. It should be used when authenticating a user via a trusted application or proxy that overrides OKTA client request context.
1.9 Authenticating with PingFederate
Set the AuthScheme to PingFederate. The following connection properties need to be set:
User: Set this to the PingFederate user.
Password: Set this to PingFederate password for the user.
SSOLoginUrl: Set this to the login url used by the SSO provider.
SSOExchangeUrl: The 'Partner Service Identifier' URI configured in your PingFederate server instance under: SP Connections > SP Connection > WS-Trust > Protocol Settings. This should uniquely identify a PingFederate SP Connection, so it is a good idea to set it to your 'AWS SSO ACS URL'. You can find it under AWS SSO > Settings > Click on 'View Details' next to the Authentication field.
The following SSOProperties are needed to authenticate to PingFederate:
AuthScheme (optional): The authorization scheme to be used for the IdP endpoint. The allowed values for this IdP are None or Basic.
Additionally, you can use the following SSOProperties to configure mutual SSL authentication for SSOLoginUrl, the WS-Trust STS endpoint:
SSLClientCert
SSLClientCertType
SSLClientCertSubject
SSLClientCertPassword
1.10 Authenticating with MFA
For users and roles that require Multi-factor Authentication, specify the following to authenticate:
AuthScheme: Set this to AwsMFA.
CredentialsLocation: The location of the settings file where MFA credentials are saved. See the Credentials File Location page under Connection String Options for more information.
MFASerialNumber: The serial number of the MFA device if one is being used.
MFAToken: The temporary token available from your MFA device.
If you are connecting to AWS (instead of already being connected such as on an EC2 instance), you must additionally specify the following:
AWSAccessKey: The access key of the IAM user for whom MFA will be issued.
AWSSecretKey: The secret key of the IAM user whom MFA will be issued.
If you are also using an IAM role to authenticate, you must additionally specify the following:
AWSRoleARN: Specify the Role ARN for the role you'd like to authenticate with. This will cause the provider to attempt to retrieve credentials for the specified role using MFA.
AWSExternalId: Only if required when you assume a role in another account.
This will cause the provider to submit the MFA credentials in a request to retrieve temporary authentication credentials.
Note that the duration of the temporary credentials may be controlled via the TemporaryTokenDuration property (default 3600 seconds).
1.11 Authenticating with a Credential File
You may use a credentials file to authenticate. Any configurations related to AccessKey/SecretKey authentication, temporary credentials, role authentication, or MFA will be used. To do so, set the following properties to authenticate:
AuthScheme: Set this to AwsCredentialsFile.
AWSCredentialsFile: Set this to the location of your credentials file.
AWSCredentialsFileProfile: Optionally set this to the name of the profile you would like to use from the specified credentials file. If not specified, the profile with the name default will be used.
The following are the connection properties for Amazon DynamoDB. Not all properties are required. Enter only property values pertaining to your installation. Several properties will be automatically initialized with the appRules defaults.
Property
|
Description
|
Authentication
| |
AccessKey | Your AWS account access key. This value is accessible from your AWS security credentials page. |
Domain | Your AWS domain name. You can optionally choose to associate your domain name with AWS. |
MFASerialNumber | The serial number of the MFA device if one is being used. |
MFAToken | The temporary token available from your MFA device. |
Region | The hosting region for your Amazon Web Services. |
RoleARN | The optional Amazon Resource Name of the role to use when authenticating. |
SecretKey | Your AWS account secret key. This value is accessible from your AWS security credentials page. |
TemporaryTokenDuration | The amount of time (in seconds) a temporary token will last. |
URL | The URL to use when submitting requests. This should not normally need to be set. |
UseEC2Roles | A boolean indicating if you would like to use EC2 credentials. |
Caching | |
AutoCache | Automatically caches the results of SELECT queries into a cache database specified by either CacheLocation or both of CacheConnection and CacheProvider . |
CacheConnection | The connection string for the cache database. This property is always used in conjunction with CacheProvider . Setting both properties will override the value set for CacheLocation for caching data. |
CacheLocation | Specifies the path to the cache when caching to a file. |
CacheMetadata | This property determines whether or not to cache the table metadata to a file store. |
CacheProvider | The name of the provider to be used to cache data. |
CacheTolerance | The tolerance for stale data in the cache specified in seconds when using AutoCache . |
Offline | Use offline mode to get the data from the cache instead of the live source. |
Firewall | |
FirewallPassword | A password used to authenticate to a proxy-based firewall. |
FirewallPort | The TCP port for a proxy-based firewall. |
FirewallServer | The name or IP address of a proxy-based firewall. |
FirewallType | The protocol used by a proxy-based firewall. |
FirewallUser | The user name to use to authenticate with a proxy-based firewall. |
Logging | |
Logfile | A path to the log file. |
MaxLogFileCount | A string specifying the maximum file count of log files. When the limit is hit, a new log is created in the same folder with the date and time appended to the end and the oldest log file will be deleted. |
MaxLogFileSize | A string specifying the maximum size in bytes for a log file (for example, 10 MB). When the limit is hit, a new log is created in the same folder with the date and time appended to the end. |
Verbosity | The verbosity level that determines the amount of detail included in the log file. |
Misc | |
AutoDetectIndex | A boolean indicating if secondary indexes should be automatically detected based on the query used. |
BufferSize | Determines the internal buffer size to fill up to before returning results. |
ConnectionLifeTime | The maximum lifetime of a connection in seconds. Once the time has elapsed, the connection object is disposed. |
ConnectionString | *** |
CredentialsFileLocation | The location of the settings file where MFA credentials are saved. |
FlattenArrays | By default, nested arrays are returned as strings of JSON. The FlattenArrays property can be used to flatten the elements of nested arrays into columns of their own. Set FlattenArrays to the number of elements you want to return from nested arrays. |
FlattenObjects | Set FlattenObjects to true to flatten object properties into columns of their own. Otherwise, objects nested in arrays are returned as strings of JSON. |
GenerateSchemaFiles | Indicates the user preference as to when schemas should be generated and saved. |
InsertMode | How to handle values when inserting if the same primary key combination already exists in DynamoDB. |
MaximumRequestRetries | The maximum number of times to retry a request. |
MaxRows | Limits the number of rows returned rows when no aggregation or group by is used in the query. This helps avoid performance issues at design time. |
NumberColumnMode | Specifies how to handle detected number columns. DynamoDB returns number values with a total precision of 38. |
Other | These hidden properties are used only in specific use cases. |
Pagesize | The maximum number of results to return per page from DynamoDB per request. |
PoolIdleTimeout | The allowed idle time for a connection before it is closed. |
PoolMaxSize | The maximum connections in the pool. |
PoolMinSize | The minimum number of connections in the pool. |
PoolWaitTime | The max seconds to wait for an available connection. |
PseudoColumns | This property indicates whether or not to include pseudo columns as columns to the table. |
Readonly | You can use this property to enforce read-only access to Amazon DynamoDB from the provider. |
RetryWaitTime | The minimum number of milliseconds the provider will wait to retry a request. |
RowScanDepth | The maximum number of rows to scan to look for the columns available in a table. |
SeparatorCharacter | The character or characters used to denote hierarchy. |
SSLServerCert | The certificate to be accepted from the server when connecting using TLS/SSL. |
SupportEnhancedSQL | This property enhances SQL functionality beyond what can be supported through the API directly, by enabling in-memory client-side processing. |
ThreadCount | The number of threads to use when selecting data via a parallel scan. Setting ThreadCount to 1 will disable parallel scans. |
Timeout | The value in seconds until the timeout error is thrown, canceling the operation. |
TypeDetectionScheme | Determines how to determine the data type of columns. |
UseConnectionPooling | This property enables connection pooling. |
UseSimpleNames | Boolean determining if simple names should be used for tables and columns. |
Proxy | |
ProxyAuthScheme | The authentication type to use to authenticate to the ProxyServer proxy. |
ProxyAutoDetect | This indicates whether to use the system proxy settings or not. This takes precedence over other proxy settings, so you'll need to set ProxyAutoDetect to FALSE in order use custom proxy settings. |
ProxyExceptions | A semicolon separated list of hosts or IPs that are exempt from connecting through the ProxyServer . |
ProxyPassword | A password to be used to authenticate to the ProxyServer proxy. |
ProxyPort | The TCP port the ProxyServer proxy is running on. |
ProxyServer | The hostname or IP address of a proxy to route HTTP traffic through. |
ProxySSLType | The SSL type to use when connecting to the ProxyServer proxy. |
ProxyUser | A user name to be used to authenticate to the ProxyServer proxy. |
Schema | |
Location | A path to the directory that contains the schema files defining tables, views, and stored procedures. |
Tables | This property restricts the tables reported to a subset of the available tables. For example, Tables=TableA,TableB,TableC. |
Views | Restricts the views reported to a subset of the available tables. For example, Views=ViewA,ViewB,ViewC. |
Last updated