Implementing Terraform State Locking with DynamoDB
Prevent state corruption in AWS by implementing Terraform state locking with DynamoDB. Learn the minimal design, IAM requirements, and how to handle stale locks.
ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Prevent state corruption in AWS by implementing Terraform state locking with DynamoDB. Learn the minimal design, IAM requirements, and how to handle stale locks.
Compare Terraform state backends — local, S3, Azure Blob, GCS, Consul, Terraform Cloud — with a decision matrix and a ready‑to‑use S3 + DynamoDB configuration.
Learn how to use ConditionExpression in DynamoDB UpdateItem to prevent race conditions and ensure attributes are updated only when they match an expected value or are absent.
Upgrading DynamoDB Global Tables to version 2019.11.09 introduces significant changes to how replication and write conflicts are handled. When an upgrade process is initiated across multiple regions, a failure during the transition can leave the table in an inconsistent state where some regions are on the new version and others remain on the legacy version.
A multi-tenant architecture utilizes IAM roles and temporary STS credentials to access DynamoDB tables. The design goal is least-privilege access, restricting actions like GetItem , PutItem , and Query to specific table and index ARNs using Signature Version 4 authentication. There is uncertainty regarding the boundary between infrastructure-level security a
Amazon DynamoDB Point-in-Time Recovery (PITR) allows for the restoration of table data to a specific timestamp within a 35-day window. However, the restoration process creates a completely new table with a unique Amazon Resource Name (ARN) rather than restoring data into the existing table structure. In environments where application configurations, IAM poli
Change boundary The goal is to define an application-level idempotency contract for DynamoDB PutItem retries when a transient failure or lost response leaves the client unable to tell whether the write committed. The documented single-item API does not provide a cross-attempt idempotency token, so a client-side retry can repeat an already successful write. T
DynamoDB Adaptive Capacity automatically splits partitions when sustained traffic concentrates on a hot key, yet the service exposes no configuration parameter, API, or console setting to define the throughput threshold that triggers a split, manually initiate one, or opt out of the behavior entirely. For integration tests that must validate partition-bounda
DynamoDB + IAM Policies: Preventing Accidental Public Access When a table is shared via an IAM policy that uses a wildcard resource ARN, any principal with permission to the broader resource can read or write the table, even if the intention was to restrict access to a specific account or service. A VPC interface endpoint can keep traffic inside a VPC, but i