Is aws-cloudformation-dynamodb safe to install?

SaferSkills independently audited aws-cloudformation-dynamodb (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-dynamodb/SKILL.md · 1 file

plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-dynamodb/SKILL.md7.6 KB · Markdown

name: aws-cloudformation-dynamodb

description: Provides AWS CloudFormation patterns for DynamoDB tables, GSIs, LSIs, auto-scaling, and streams. Use when creating DynamoDB tables with CloudFormation, configuring primary keys, local/global secondary indexes, capacity modes (on-demand/provisioned), point-in-time recovery, encryption, TTL, and implementing template structure with Parameters, Outputs, Mappings, Conditions, cross-stack references.

allowed-tools: Read, Write, Bash

AWS CloudFormation DynamoDB Patterns

Provides production-ready NoSQL database infrastructure patterns using AWS CloudFormation templates with DynamoDB tables, GSIs, LSIs, auto-scaling, encryption, TTL, and streams.

Overview

Covers DynamoDB tables, primary keys, secondary indexes (GSI/LSI), capacity modes, auto-scaling, encryption, TTL, streams, and best practices for parameters, outputs, and cross-stack references.

When to Use

Creating DynamoDB tables, configuring keys and indexes, setting capacity modes, implementing auto-scaling, enabling encryption/TTL/streams, and organizing CloudFormation templates.

Instructions

Follow these steps to create DynamoDB tables with CloudFormation:

Define Table Parameters: Specify table name and billing mode
Configure Primary Key: Set partition key and optional sort key
Add Secondary Indexes: Create GSIs for alternative access patterns
Configure Encryption: Enable encryption using KMS keys
Set Up TTL: Define timestamp attribute for automatic deletion
Enable Streams: Configure stream for change data capture
Add Auto Scaling: Implement Application Auto Scaling for provisioned capacity
Create Backup: Enable point-in-time recovery
Validate Template: Run aws cloudformation validate-template before deployment
Deploy Stack: Use aws cloudformation create-stack or update-stack
Monitor Events: Check aws cloudformation describe-stack-events for failures or ROLLBACK status
Handle Rollback: On failure, review events for resource errors, fix the template, and re-deploy

Quick Reference

Resource Type	Purpose
`AWS::DynamoDB::Table`	Create DynamoDB table
`AWS::ApplicationAutoScaling::ScalableTarget`	Auto scaling configuration
`AWS::ApplicationAutoScaling::ScalingPolicy`	Scaling policies
`AWS::KMS::Key`	KMS key for encryption
`AWS::IAM::Role`	IAM roles for auto scaling
BillingMode	`PAY_PER_REQUEST` or `PROVISIONED`
SSESpecification	Server-side encryption

Examples

Basic Table with On-Demand Capacity

DynamoDBTable:
  Type: AWS::DynamoDB::Table
  Properties:
    TableName: !Sub "${AWS::StackName}-table"
    BillingMode: PAY_PER_REQUEST
    AttributeDefinitions:
      - AttributeName: pk
        AttributeType: S
    KeySchema:
      - AttributeName: pk
        KeyType: HASH

Table with Global Secondary Index

DynamoDBTable:
  Type: AWS::DynamoDB::Table
  Properties:
    TableName: !Sub "${AWS::StackName}-table"
    BillingMode: PAY_PER_REQUEST
    AttributeDefinitions:
      - AttributeName: pk
        AttributeType: S
      - AttributeName: gsi-pk
        AttributeType: S
    KeySchema:
      - AttributeName: pk
        KeyType: HASH
    GlobalSecondaryIndexes:
      - IndexName: gsi-index
        KeySchema:
          - AttributeName: gsi-pk
            KeyType: HASH
        Projection:
          ProjectionType: ALL

Table with TTL

SessionTable:
  Type: AWS::DynamoDB::Table
  Properties:
    TableName: !Sub "${AWS::StackName}-sessions"
    BillingMode: PAY_PER_REQUEST
    AttributeDefinitions:
      - AttributeName: sessionId
        AttributeType: S
    KeySchema:
      - AttributeName: sessionId
        KeyType: HASH
    TimeToLiveSpecification:
      AttributeName: expiresAt
      Enabled: true

Table with Auto Scaling

ScalableTarget:
  Type: AWS::ApplicationAutoScaling::ScalableTarget
  Properties:
    MaxCapacity: 100
    MinCapacity: 5
    ResourceId: !Sub "table/${DynamoDBTable}"
    RoleARN: !GetAtt AutoScalingRole.Arn
    ScalableDimension: dynamodb:table:ReadCapacityUnits
    ServiceNamespace: dynamodb

See references/complete-examples.md for more complete examples including encryption, streams, auto scaling, and production tables.

Template Structure

Base Template

AWSTemplateFormatVersion: 2010-09-09
Description: DynamoDB table with GSI and auto-scaling

Parameters:
  TableName:
    Type: String
    Default: my-table
  BillingMode:
    Type: String
    Default: PAY_PER_REQUEST

Resources:
  DynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Ref TableName
      BillingMode: !Ref BillingMode

Outputs:
  TableName:
    Value: !Ref DynamoDBTable
  TableArn:
    Value: !GetAtt DynamoDBTable.Arn

See references/advanced-configuration.md for detailed Parameters, Mappings, Conditions, Outputs, IAM roles, and cross-stack references.

Best Practices

Use PAY_PER_REQUEST for development/testing and unpredictable workloads
Enable Point-In-Time Recovery for production tables
Use KMS encryption for sensitive data (SSE-KMS)
Configure auto-scaling for provisioned capacity tables
Design GSIs carefully - each GSI consumes capacity
Use TTL for automatic data expiration (sessions, cache)
Enable Streams for change data capture and analytics
Tag resources for cost allocation and organization
Export outputs for cross-stack references
Use Conditions for environment-specific configurations

Common Troubleshooting

Table already exists: Use unique table names or stack deletion policy GSI creation fails: Verify attribute definitions include GSI attributes Auto-scaling not working: Check IAM role permissions and service-linked role TTL not expiring: Ensure TTL attribute is Number type, not String Streams not enabled: Can only enable streams during table creation Encryption errors: Verify KMS key exists in same region as table

aws-cloudformation-security - Security best practices for DynamoDB
aws-cloudformation-lambda - Lambda triggers for DynamoDB Streams
aws-cloudformation-iam - IAM roles for DynamoDB access

References

Complete Examples

[references/complete-examples.md](references/complete-examples.md) - Basic tables, GSI, LSI, TTL, encryption, PITR, auto-scaling, production tables, global tables, streams

Advanced Configuration

[references/advanced-configuration.md](references/advanced-configuration.md) - Parameters, Mappings, Conditions, auto scaling policies, streams, TTL, global tables, outputs, IAM roles, deletion policies

Constraints and Warnings

Table names: Must be unique per region (globally unique for global tables)
GSI limits: Maximum 5 GSIs per table (for single-region tables)
LSI limits: Maximum 5 LSIs per table, same partition key as table
Capacity limits: On-demand has default account limits (40,000 RCUs, 40,000 WCUs)
Auto-scaling: Requires PROVISIONED billing mode (not PAY_PER_REQUEST)
Point-in-time recovery: Can only be enabled during table creation
Streams: Can only be enabled during table creation
Encryption: KMS keys must be in same region as table
TTL: Attribute must be Number type, measured in seconds
Throughput: Each GSI shares provisioned throughput with table
Item size limit: Maximum 400 KB per item
Hot partition: Design keys to avoid hot partition issues

aws-cloudformation-dynamodb— agent skill

Is aws-cloudformation-dynamodb safe to install?

AWS CloudFormation DynamoDB Patterns

Overview

When to Use

Instructions

Quick Reference

Examples

Basic Table with On-Demand Capacity

Table with Global Secondary Index

Table with TTL

Table with Auto Scaling

Template Structure

Base Template

Best Practices

Common Troubleshooting

References

Complete Examples

Advanced Configuration

Constraints and Warnings

Audit the pieces. Scan the whole. Decide.

Is aws-cloudformation-dynamodb safe to install?

AWS CloudFormation DynamoDB Patterns

Overview

When to Use

Instructions

Quick Reference

Examples

Basic Table with On-Demand Capacity

Table with Global Secondary Index

Table with TTL

Table with Auto Scaling

Template Structure

Base Template

Best Practices

Common Troubleshooting

Related Skills

References

Complete Examples

Advanced Configuration

Constraints and Warnings

Audit the pieces. Scan the whole. Decide.