Readme - terraform-aws-modules/dynamodb-table (CIS AWS Benchmark v6.0.0)

AWS DynamoDB Table Terraform module

Terraform module to create a DynamoDB table.

Usage

module "dynamodb_table" {
  source   = "terraform-aws-modules/dynamodb-table/aws"

  name     = "my-table"
  hash_key = "id"

  attributes = [
    {
      name = "id"
      type = "N"
    }
  ]

  tags = {
    Terraform   = "true"
    Environment = "staging"
  }
}

Notes

Warning: enabling or disabling autoscaling can cause your table to be recreated

There are two separate Terraform resources used for the DynamoDB table: one is for when any autoscaling is enabled the other when disabled. If your table is already created and then you change the variable autoscaling_enabled then your table will be recreated by Terraform. In this case you will need to move the old aws_dynamodb_table resource that is being destroyed to the new resource that is being created. For example:

terraform state mv module.dynamodb_table.aws_dynamodb_table.this module.dynamodb_table.aws_dynamodb_table.autoscaled

Warning: autoscaling with global secondary indexes

When using an autoscaled provisioned table with GSIs you may find that applying TF changes whilst a GSI is scaled up will reset the capacity, there is an open issue for this on the AWS Provider. To get around this issue you can enable the ignore_changes_global_secondary_index setting however, using this setting means that any changes to GSIs will be ignored by Terraform and will hence have to be applied manually (or via some other automation).

NOTE: Setting ignore_changes_global_secondary_index after the table is already created causes your table to be recreated. In this case, you will need to move the old aws_dynamodb_table resource that is being destroyed to the new resource that is being created. For example:

terraform state mv module.dynamodb_table.aws_dynamodb_table.autoscaled module.dynamodb_table.aws_dynamodb_table.autoscaled_ignore_gsi

Module wrappers

Users of this Terraform module can create multiple similar resources by using for_each meta-argument within module block which became available in Terraform 0.13.

Users of Terragrunt can achieve similar results by using modules provided in the wrappers directory, if they prefer to reduce amount of configuration files.

Known limitations (Terraform/OpenTofu, not this module)

A few requests come up again and again and cannot be implemented by this module, or by any module: Terraform requires lifecycle arguments to be literal values inside the resource block. hashicorp/terraform#18367 has been open since 2018, #22544 since 2019, and opentofu/opentofu#1329 is the same request for OpenTofu.

DynamoDB read and write capacity reverts on every plan - Native option: switch the table to PAY_PER_REQUEST billing. Otherwise fork and add ignore_changes = [read_capacity, write_capacity].
terraform destroy deleted a DynamoDB table - Native option: set deletion_protection_enabled = true and turn on point-in-time recovery, both of which this module already exposes.

Compliance.tf serves this module with these rules applied at download time, on top of whatever your organization already has enabled there. Inputs and outputs do not change; the source line does. Drop the version argument and pin the release you use by adding &version= and that release number to the URL. To get started, register a free compliance.tf account and configure an access token:

source = "https://registry.compliance.tf/terraform-aws-modules/dynamodb-table/aws?add_rules=lifecycle_ignore_autoscaling_changes,lifecycle_prevent_destroy_data"

The full workaround for each item above, and the exact diff each rule makes, are in the compliance.tf docs for this module. To preview a diff without an account, open this module in the Rules Playground.

Disclosure: written by this module's maintainer, who also builds compliance.tf.

AWS DynamoDB Table Terraform module

Usage

Notes

Module wrappers

Known limitations (Terraform/OpenTofu, not this module)

Examples

Authors

License