Amazon DynamoDB

Amazon DynamoDB is a cloud-based NoSQL database service provided by AWS, aimed at simplifying the configuration, operation, and scalability of NoSQL databases for applications. It offers features such as automatic scaling, data replication, and seamless integration with other AWS services, making it an efficient choice for developers building scalable and dynamic applications.

The Amazon DynamoDB integration has two options to connect:

1. A direct connection to the DynamoDB database
2. Connecting to the DynamoDB database using a Lambda

Details

In order to integrate Relyance with DynamoDB, Relyance will need to assume a role on your behalf.

Role assumption in AWS allows entities (like IAM users, services, or even external identities) to take on an IAM role, granting them temporary permissions to perform specific actions on specific resources without having to attach permissions directly to their identity.

By assuming a role, one gets temporary security credentials to act with the permissions of the role, ensuring a flexible and secure way to delegate and segregate duties without distributing long-lived credentials.

There are two necessary preconditions that must be met for a principal (the Relyance AI System, in this case) to assume a role.

1. The entity needs to have permission to use the sts:AssumeRole action for the specific role they want to assume.
2. The role must have a trust policy that allows the principal to use it.

Direct Connection:

---

The direct connection to DynamoDB requires you to create an Amazon Policy and Role in order to connect to your DynamoDB. This section ensures you can share your DynamoDB database with the Relyance App.

In order to integrate DynamoDB with Relyance AI you will need an Account ID, Role Name, External ID, Region and Table Name.

In Amazon DynamoDB:

1. Log in to your AWS management console.
2. Copy your Account ID from the top right-side drop down menu.

Create a custom policy

1. Navigate to the IAM console and create a new policy.
2. Select DynamoDB as the service.
3. In the actions allowed select:
   • Read: Query
   • Read: DescribeTable
   • Read: Scan
4. In the Resources section specify ‘ All ’ or provide a ARN of your table.
   • Note: if you provide an ARN of a specific table, then Relyance will only be able to scan one table
5. If you have enabled encryption via KMS on your DynamoDB table, then please add an additional permissions:
   1. Click on "+ Add more permissions"
   2. Select KMS as the service.
   3. In the actions allowed select:
      1. Write: Decrypt
   4. In the Resources section specify the ARN of your KMS key.
      • Note: If you don't know the ARN, open the DynamoDB table you want to connect in the AWS Console and click on: "Additional info" under "General Information". In there, you will see a section called: "Encryption". Copy the ARN.
6. Go to the next page and provide a meaningful name (e.g. DynamoDB_RelyanceScan_Policy).
7. Click Create Policy.

Create Role

1. Navigate to the IAM console and create a new role.
2. Choose AWS Account as the AWS service that will use this role.
3. Click Next.
4. Apply the policy that was previously created and click Next.
5. Provide a meaningful name (e.g. DynamoDB_RelyanceScan_Role) and click Create role.
6. Open the newly created role and open the Trust relationships tab.
7. Edit the trust policy to be:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::580082088342:user/tenant-prod-access"
      },
      "Action": "sts:AssumeRole",
      "Condition": {                "StringEquals": {                    "sts:ExternalId": "relyance-dynomodb-integration-scan"                }            }
    }
  ]
}

The External ID (relyance-dynomodb-integration-scan) can be whatever you wish. This further secures the Lambda role. 8. Copy the Role Name.

In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the Settings (bottom-left corner).
3. Select Integrations.
4. Search and locate the Amazon DynamoDB integration card and click on it.
5. Click on the Add Connection button on the top right
6. Provide a meaningful name for the integration and click on the Add button
7. In the Overview section, select the integration features you wish to enable for the integration, review the Scope and Permission, and Endpoint details and click on Continue. For more details, see Integration Features

8. In the Connection section, provide the appropriate values and click on Continue,

9. In the Authentication section, provide the Account ID, Role Name, External ID, Region: The AWS region where the resource exists, DynamoDB Table Name: The table to be scanned, Sampling Percent: Used in conjunction with the Data Inspection. This is the percentage of the table to scan.

   • DynamoDB Tables: the required list of tables to scan. Use the JSON editor and provide the table names, for example:

     [
       "orders",
       "customers"
     ]

10. If the Data Inspection check box is checked from step 7, in the Data Inspection section, provide the appropriate values and click on Continue Sampling Percentage : This property adjusts the percentage of records using the table's row count (1000 records max) to return from a table. Minimum Confidence Level: This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g., unlikely) offer more coverage but may produce false positives, while higher sensitivity (e.g., very likely) provides greater accuracy but less coverage.

11. Review the configuration summary from the Completion section and click on Finish

12. Confirm the integration Status reflects Connected

Connecting to the DynamoDB database using a Lambda

---

In our quest for a secure database integration, we recommend utilizing AWS Lambda as a proxy to gain access to Amazon DynamoDB. This method not only ensures a tight-knit security layer but also ensures your team can have peace of mind.

Benefits of Using AWS Lambda for DynamoDB Integration with Relyance:

Data Confidentiality: You can keep your database username and password confidential. By integrating with Relyance this way, you won't have to share these critical credentials, ensuring an added layer of security.

Temporary Access: Relyance will assume a role you provide. Following this, AWS's Security Token Service (STS) springs into action, offering temporary security credentials. These credentials come with a session token that's time-bound - they only last 15 minutes. So, even in an unforeseen situation, there's a minimal window of opportunity for any malicious intent.

No Direct Database Access: With this integration, you'll be keeping Relyance and other third-party entities at arm's length from your database. Since you have full control and can trust the Lambda function acting as a mediator, threats of unauthorized access or unintended permission escalations are virtually non-existent.

In order to integrate DynamoDB with Relyance AI you will need an Account ID, Role Name, External ID, Region, Lambda Function Name, and Table Name.

In Amazon DynamoDB:

1. Log in to your AWS management console.
2. Copy your Account ID from the top right-side drop down menu. Create a custom policy:
3. Navigate to the IAM console and create a new policy.
4. Select DynamoDB as the service.
5. In the actions allowed select:
   • Read: Query
   • Read: DescribeTable
   • Read: Scan
6. In the Resources section select All.
7. Click the Next button to continue to the next page.
8. Provide a meaningful policy name (e.g. DynamoDb-RelyanceScan-Policy) IAM Role for AWS Lambda:
9. Navigate to the IAM console and create a new role.
10. Choose Lambda as the AWS service that will use this role.
11. Grant permissions for:
    • AWSLambdaRole
    • Add the previously created customer policy (e.g. DynamoDb-RelyanceScan-Policy)
12. Provide a meaningful Role name (e.g. DynamoDB_Lambda-RelyanceScan-Role )
13. Create the role.
14. Note the Role Name and Role Arn ( External ID). Add Lambda:
15. Navigate to the Lambda section in AWS and click on Create function.
16. Choose Author from Scratch.
17. Provide a meaningful name (e.g. DynamoDB-RelyanceScan-Lambda)
18. In the Runtime, choose Python 3.9.
19. For Architecture choose x86_64.
20. Open up Change default execution role and select the Use an existing role radio button.
21. Find the Role previously created.
22. Create the function. Once the function is created:
23. In the Code tab scroll down to Runtime settings and update the Handler to be src.main.lambda_handler.
24. Go to the Configuration tab and update the function Timeout to 15 minutes. Build the function:
25. In the Code tab, click the Upload from> .zip file
26. Choose the provided lambda.zip file to upload.
27. From the Lambda left-side navigation panel, select Layers.
28. Click the Create Layer button.
29. Give it a name like ' Relyance Integration layer '.
30. Select Upload from zip file and follow the wizard to attach the relyance-integration-layer.zip file.
31. Select x86_64 under Compatible Architectures and then Python 3.9 in the Compatible Runtimes. Add the Layer to the new Lambda:
32. Navigate back to the new lambda function, then from the Code tab scroll down and find the Add a Layer button at the bottom
33. Select Custom Layers then select the new Relyance Integration layer. Update the new Role for Relyance to execute the Lambda:
34. Navigate to the IAM> Roles section in AWS.
35. Open the previously created role (e.g. DynamoDB_Lambda-RelyanceScan-Role)
36. Click on the Trust Relationships tab and update the trust policy from this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

To this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {                "AWS": "arn:aws:iam::580082088342:user/tenant-prod-access",	        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole",            "Condition": {                "StringEquals": {                    "sts:ExternalId": "relyance-lambda-dynomodb-integration-scan"                }            }	}
  ]
}

The External ID (relyance-lambda-dynomodb-integration-scan) can be whatever you wish. This further secures the Lambda role. Other settings: 37. Select which Region your AWS instance should use (e.g. us-east-1).

In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the Settings (bottom-left corner).
3. Select Integrations.
4. Search and locate the Amazon DynamoDB integration card and click on it.
5. Click on the Add Connection button on the top right .
6. Provide a meaningful name for the integration and click on the Add button
7. In the Overview section, select the integration features you wish to enable for the integration, review the Scope and Permission, and Endpoint details and click on Continue. For more details, see Integration Features
8. In the Connection section, provide the appropriate values and click on Continue,

9. In the Authentication section, for AWS Lambda based authentication provide the Account ID, Role Name, External ID, Region, Lambda Function Name, Region: The AWS region where the resource exists, DynamoDB Table Name: The table to be scanned, Sampling Percent: Used in conjunction with the Data Inspection. This is the percentage of the table to scan.
   • DynamoDB Tables: the required list of tables to scan. Use the JSON editor and provide the table names, for example:

     [
       "orders",
       "customers"
     ]

   • For IAM-Based Auth, provide the Role ARN, External ID, Crawler configuration and click on Continue.
10. If the Data Inspection check box is checked from step 7, In the Data Inspection section, provide the appropriate values and click on Continue Sampling Percentage : This property adjusts the percentage of records using the table's row count (1000 records max) to return from a table. Minimum Confidence Level: This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g., unlikely) offer more coverage but may produce false positives, while higher sensitivity (e.g., very likely) provides greater accuracy but less coverage.

11. Review the configuration summary from the Completion section and click on Finish.
12. Confirm the integration Status reflects Connected

Create the AWS side with Terraform

The role, its trust policy and its permissions are available as a Terraform module, generated from the permissions Relyance actually uses so it cannot drift from this page:

module "relyance_aws" {
  source  = "assets.relyance.ai/relyance/integration/aws"
  version = "~> 1.0"

  relyance_principal_arns = ["arn:aws:iam::580082088342:user/tenant-prod-access"]
  external_id             = var.relyance_external_id

  integrations = {
    aws_dynamodb = {
      resource_arns = ["arn:aws:dynamodb:us-east-1:111122223333:table/acme-users"]
      # Only for tables on a customer-managed KMS key. Omit it and no KMS
      # statement is created.
      kms_key_arns = ["arn:aws:kms:us-east-1:111122223333:key/abcd-1234"]
    }
  }
}

Set all_resources = true instead of resource_arns to cover every table in the account — the module requires one or the other, so broad access is never the silent default.

Verify the connection is really working

The permissions divide by what they read, and that split is why a connection can look healthy and classify nothing:

1. Tables and schemas appear, but no data types are classified. Either Scan/Query are missing, or the table is on a customer-managed key and kms:Decrypt is not granted on that key. Both look identical from the product: the asset is there and the classification is empty. The key ARN is on the table's Additional info › Encryption panel in the AWS console.
2. A failure at Authenticate is the trust policy or the external ID. The role's trust relationship must name the Relyance principal and match the external ID on the connection exactly.
3. Fewer tables than expected. For Direct Connection and AWS Lambda the DynamoDB Tables field is the scope — only tables named there are scanned. Scoping the policy to a single table ARN has the same effect and is easy to forget.
4. One connection per account and region. Account ID, role and region belong to a single connection, so a second account or region needs a second connection.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

AWS IAM role — Direct Connection

resource "relyance_integration_connection" "aws_dynamodb_0" {
  vendor = "aws_dynamodb"
  name   = "<your connection name>"

  auth = {
    method = "iam-role-direct"
    params = {
      account_id = "<account_id>"
      role_name = "<role_name>"
      region = "<region>"
      tables = jsonencode([
        ""
      ])
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      external_id = var.aws_dynamodb_external_id
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}

AWS IAM role — AWS Lambda

resource "relyance_integration_connection" "aws_dynamodb_1" {
  vendor = "aws_dynamodb"
  name   = "<your connection name>"

  auth = {
    method = "iam-role-aws-lambda"
    params = {
      account_id = "<account_id>"
      role_name = "<role_name>"
      region = "<region>"
      lambda_function_name = "<lambda_function_name>"
      tables = jsonencode([
        ""
      ])
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      external_id = var.aws_dynamodb_external_id
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}

AWS IAM role — IAM-based Auth

resource "relyance_integration_connection" "aws_dynamodb_2" {
  vendor = "aws_dynamodb"
  name   = "<your connection name>"

  auth = {
    method = "iam-role-based"
    params = {
      role_arn = "<role_arn>"
      crawler_rules = jsonencode({
        allow_list = [
          ""
        ]
        block_list = [
          ""
        ]
      })
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      external_id = var.aws_dynamodb_external_id
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}