DynamoDB
Database · AWS
Explanation pending
2 concepts teach DynamoDB, so everything below is real — but the written explanation hasn't been authored yet. It appears in the build report as work to do, and nothing invented fills the gap in the meantime.
Properties CloudSynth teachesderived from synthesized templates
These are the CloudFormation properties you actually configure in the lessons — read out of the template the reference solution synthesizes, so this list can't drift from what's taught.
| Resource | Property | Taught in |
|---|---|---|
| AWS::DynamoDB::Table | AttributeDefinitions | dynamodb-02-create-table, dynamodb-03-query-and-create, dynamodb-04-update-item, single-page-app-03-fix-the-integration, single-page-app-04-grant-the-permission |
| AWS::DynamoDB::Table | BillingMode | dynamodb-02-create-table, dynamodb-03-query-and-create, dynamodb-04-update-item, single-page-app-03-fix-the-integration, single-page-app-04-grant-the-permission |
| AWS::DynamoDB::Table | KeySchema | dynamodb-02-create-table, dynamodb-03-query-and-create, dynamodb-04-update-item, single-page-app-03-fix-the-integration, single-page-app-04-grant-the-permission |
| AWS::DynamoDB::Table | TableName | dynamodb-02-create-table, dynamodb-03-query-and-create, dynamodb-04-update-item |
Security & best practice
CloudSynth grades your infrastructure against the same cdk-nag rules real teams run in CI. These are the rules that actually fire on the lessons' templates:
AwsSolutions-APIG1The API does not have access logging enabled. Enabling access logs helps operators view who accessed an API and how the caller accessed the API.
AwsSolutions-APIG2The REST API does not have request validation enabled. The API should have basic request validation enabled. If the API is integrated with custom source (Lambda, ECS, etc..) in the backend, deeper input validation should be considered for implementation.
AwsSolutions-APIG3The REST API stage is not associated with AWS WAFv2 web ACL. AWS WAFv2 is a web application firewall that helps protect web applications and APIs from attacks by allowing configured rules to allow, block, or monitor (count) web requests based on customizable rules and conditions that are defined.
AwsSolutions-APIG4The API does not implement authorization. In most cases an API needs to have an authentication and authorization implementation strategy. This includes using such approaches as IAM, Cognito User Pools, Custom authorizer, etc.
AwsSolutions-APIG6The REST API Stage does not have CloudWatch logging enabled for all methods. Enabling CloudWatch logs at the stage level helps operators to track and analyze execution behavior at the API stage level.
AwsSolutions-COG4The API GW method does not use a Cognito user pool authorizer. API Gateway validates the tokens from a successful user pool authentication, and uses them to grant your users access to resources including Lambda functions, or your own API.
AwsSolutions-DDB3The DynamoDB table does not have Point-in-time Recovery enabled. DynamoDB continuous backups represent an additional layer of insurance against accidental loss of data on top of on-demand backups. The DynamoDB service can back up the data with per-second granularity and restore it to any single second from the time PITR was enabled up to the prior 35 days.
AwsSolutions-S1The S3 Bucket has server access logs disabled. The bucket should have server access logging enabled to provide detailed records for the requests that are made to the bucket.
AwsSolutions-S10The S3 Bucket or bucket policy does not require requests to use SSL. You can use HTTPS (TLS) to help prevent potential attackers from eavesdropping on or manipulating network traffic using person-in-the-middle or similar attacks. You should allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition on Amazon S3 bucket policies.
AwsSolutions-S2The S3 Bucket does not have public access restricted and blocked. The bucket should have public access restricted and blocked to prevent unauthorized access.
AwsSolutions-S5The S3 static website bucket either has an open world bucket policy or does not use a CloudFront Origin Access Identity (OAI) in the bucket policy for limited getObject and/or putObject permissions. An OAI allows you to provide access to content in your S3 static website bucket through CloudFront URLs without enabling public access through an open bucket policy, disabling S3 Block Public Access settings, and/or through object ACLs.
For your role
Developer
Relevant to this role — role note not yet written.
DevOps / Platform
Relevant to this role — role note not yet written.
Solutions Architect
Relevant to this role — role note not yet written.
Combines with
Build it, graded
Reading is half of it. Everything above you can go build in the browser — your CDK code synthesized and graded against these exact properties.