"aws dynamodb list-tables" is not working on ec2 instance

2
votes

I've created a node.js application which connects to DynamoDB. Everything is working fine locally Now I'm trying to setup on AWS servers.

  1. First I've created DynamoDB tables from AWS DynamoDB console. It is working fine.
  2. I've created a new role from IAM management console > Roles to access DynamoDB. And attached that role to EC2 instance. But when I fire any aws dynamodb cli command, it gave me error to mention the region.
  3. So I went to IAM management console > Users, and created an access key to my admin type user.
  4. Now I'm login to EC2 CLI using ec2-user and aws configure with previously generated access key.
AWS Access Key ID [None]: ACCESS KEY
AWS Secret Access Key [None]: SECRET
Default region name [None]: us-east-1
Default output format [None]: json
  1. But when I use following command aws dynamodb list-tables. It gives no output, no error.
2
amazon-web-servicesamazon-ec2amazon-dynamodb
can you elaborate the steps a little more. - rohitwtbs
Check your region. - cementblocks
Also please don't put your admin access keys on your instance. Attach an IAM role to your instance instead and give it the least permissions necessary. - cementblocks
Generating AWS key alone is not enough. Or use search engine and look for something like "step by step configure dynamodb ec2" docs.aws.amazon.com/amazondynamodb/latest/developerguide/… - mootmoot
@cementblocks how to remove the access key now? - Amit Kumar Gupta

2 Answers

1
votes

As I commented, The main issue was outbound rules for attached security group. Here are the necessary things to do

  1. Set a security group outbound rule to HTTPS enter image description here
  2. Setup Credentials
    1. Create Access Key from IAM management console > Users.
    2. SSH to EC2 instance.
    3. Configure the credentials to EC2 instance using aws configure command or directly modify ~/.aws/credentials file.
  3. Attach Role
    1. Create Role from IAM management console > Roles. Select the role which is necessary to perform operation on AWS service. Eg AmazonDynamoDBFullAccess
    2. Open VPC console and select the EC2 instance.
    3. Attach the role from Actions menu enter image description here

It is good, though optional, to create VPC endpoint. If you face UnauthorizedOperation error while creating endpoint, assign AmazonEC2FullAccess permission to the user from IAM console. Remove it later if you don't need it.

To use the AWS service from your application, find the relevant endpoint from this list.

0
votes

It sounds like you are having problems connecting to DynamoDB because of the way you have configured your VPC.

There are some options but if you would prefer to keep your VPC isolated from the internet then you could enable VPC endpoints for DynamoDB. That way you can access DynamoDB from within your VPC without those connections going over the public internet.

There is a step-by-step guide for how to do that here: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/vpc-endpoints-dynamodb.html

Essentially, it involves the following steps:

  1. you have to get the VPC id for the VPC where your EC2 instance is located
  2. create a VPC endpoint for DynamoDB, specifying the VPC id and the regional dynamodb service name:
aws ec2 create-vpc-endpoint --service-name com.amazonaws.<region>.dynamodb --vpc-id <yourvpcid>