connecting-lambda-to-dynamodb

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, database, dynamodb, integration, lambda.

What it does

Connects an AWS Lambda function to DynamoDB with IAM roles, stream event source mapping, and read/write permissions. Use when setting up Lambda-DynamoDB integration, processing DynamoDB stream events, or deploying serverless event-driven architectures.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill connecting-lambda-to-dynamodb

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/serverless-skills/connecting-lambda-to-dynamodb ~/.claude/skills/connecting-lambda-to-dynamodb

Safety box score

Grade C, moderate risk: 44 of 100 risk points, rated 2026-10-17. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill provisions and connects AWS Lambda, DynamoDB, IAM, and CloudWatch resources, and it also generates and runs a local Lambda deployment package for testing. The main risks are broad cloud-side effects and permission changes in the caller’s AWS account, not local machine damage.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It requires the agent to run AWS CLI commands like `aws sts get-caller-identity` and to build a ZIP deployment package, but it ships no native shell script or binary.
Network access	2 (moderate)	It makes AWS API calls to IAM, Lambda, DynamoDB, and CloudWatch, and the setup/test flow sends event data and logs to AWS services.
Filesystem reach	1 (low)	It writes local workspace artifacts such as `lambda_function.py`, a deployment ZIP, and a test event file, but does not call for editing dotfiles or system paths.
Secrets & credentials	1 (low)	It depends on the user’s existing AWS CLI credentials (`aws sts get-caller-identity`) but does not ask for secrets to be pasted or read secret stores directly.
Privilege & persistence	2 (moderate)	It creates an IAM execution role, attaches `AWSLambdaDynamoDBExecutionRole`, and sets a Lambda trust policy, which changes AWS permissions in the account.
Instruction hijack surface	0 (none)	The files do not contain hidden prompts, remote-instruction fetching, or attempts to bypass user confirmation; the “MUST NOT create any resources without user approval” text is a normal safety gate.
Irreversible actions	3 (high)	It provisions infrastructure, deploys Lambda, enables DynamoDB streams, creates event source mapping, and performs test invocations—broad AWS-side actions with irreversible account changes.
Transparency	0 (none)	The skill files are plain markdown with readable commands and no binaries, base64 blobs, or generated/obfuscated code.

Before installing

Read `references/lambda-dynamodb-connection.md` and confirm you are comfortable creating IAM, Lambda, and DynamoDB resources in your AWS account.
Run `aws sts get-caller-identity` in the intended AWS profile first to verify which account the skill will change.
Make sure the workspace is disposable or backed up, since the skill writes `lambda_function.py`, a ZIP package, and test event files.
If this is production-adjacent, verify whether the attached `AWSLambdaDynamoDBExecutionRole` permissions are acceptable for your Lambda.

Rated 2026-10-17 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/serverless-skills/connecting-lambda-to-dynamodb/SKILL.md
Branch: main
Updated: 2026-09-19

connecting-lambda-to-api-gateway — Connects an existing AWS Lambda function to Amazon API Gateway by creating a REST or HTTP API with resource/method setup, Lambda proxy integration.
aws-serverless — Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK.
creating-data-lake-table — Create managed Iceberg tables using Amazon S3 Tables (s3tables API namespace) with automatic compaction and snapshot management.
storing-and-querying-vectors — Store and query vector embeddings using Amazon S3 Vectors, a cost-effective long-term vector storage service with its own API namespace (s3vectors).
amazon-dynamodb — Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition/sort keys and GSIs.
amazon-neptune — Provides authoritative guidance on Amazon Neptune Database and Neptune Analytics for graph, knowledge-graph.