{"id":18952292,"url":"https://github.com/step-security/dynamodb-actions","last_synced_at":"2026-04-13T07:24:20.836Z","repository":{"id":210115576,"uuid":"725752433","full_name":"step-security/dynamodb-actions","owner":"step-security","description":"Integrate Github Action with Amazon DynamoDB. Secure drop-in replacement for mooyoul/dynamodb-actions.","archived":false,"fork":false,"pushed_at":"2025-06-16T00:35:23.000Z","size":294,"stargazers_count":3,"open_issues_count":13,"forks_count":4,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-06-16T01:32:49.486Z","etag":null,"topics":["step-security-maintained-actions"],"latest_commit_sha":null,"homepage":"https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/step-security.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-11-30T19:56:42.000Z","updated_at":"2025-06-14T16:37:24.000Z","dependencies_parsed_at":"2023-11-30T22:25:15.429Z","dependency_job_id":"8de0ce81-269e-4c24-8d6a-632f6d5a8c80","html_url":"https://github.com/step-security/dynamodb-actions","commit_stats":null,"previous_names":["step-security/dynamodb-actions"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/step-security/dynamodb-actions","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fdynamodb-actions","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fdynamodb-actions/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fdynamodb-actions/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fdynamodb-actions/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/step-security","download_url":"https://codeload.github.com/step-security/dynamodb-actions/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Fdynamodb-actions/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262145451,"owners_count":23265926,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["step-security-maintained-actions"],"created_at":"2024-11-08T13:32:36.971Z","updated_at":"2026-04-13T07:24:20.822Z","avatar_url":"https://github.com/step-security.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![StepSecurity Maintained Action](https://raw.githubusercontent.com/step-security/maintained-actions-assets/main/assets/maintained-action-banner.png)](https://docs.stepsecurity.io/actions/stepsecurity-maintained-actions)\n\n# StepSecurity maintained dynamodb-actions action\n\nGitHub action that integrates with Amazon DynamoDB.\n\nInspired from [DynamoDB integration in AWS Step Functions](https://docs.aws.amazon.com/step-functions/latest/dg/connect-ddb.html)\n\n## Supported Operations\n\n### Get Item\n\nGet Item from DynamoDB and Returns JSON-serialized Item payload.\n\n##### Example\n\n```yaml\n# ...\njobs:\n  job:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Get DynamoDB Item\n        id: config\n        uses: step-security/dynamodb-actions@v1\n        env:\n          AWS_DEFAULT_REGION: us-east-1\n          AWS_REGION: us-east-1\n          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}\n          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}\n        with:\n          operation: get\n          region: us-east-1\n          table: my-awesome-config\n          key: |\n            { key: \"foo\" }\n      - name: Print item\n        run: |\n          echo '${{ steps.config.outputs.item }}'\n      - name: Print specific field using built-in function\n        run: |\n          echo '${{ fromJson(steps.config.outputs.item).commit }}'\n      - name: Print specific field using jq\n        run: |\n          jq '.commit' \u003c\u003c\u003c '${{ steps.config.outputs.item }}'\n```\n\n\n##### Input\n\n```typescript\ntype GetItemInput = {\n  operation: \"get\";\n  region: string;\n  table: string;\n  key: string; // JSON-serialized key\n  consistent?: boolean;\n}\n```\n\n##### Output\n\nJSON-serialized item will be set to `item` output.\n\n### Put Item\n\nPut Item to DynamoDB\n\n##### Example\n\nwith JSON input:\n\n```yaml\n# ...\njobs:\n  job:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v2\n      - name: Put DynamoDB Item\n        uses: step-security/dynamodb-actions@v1\n        env:\n          AWS_DEFAULT_REGION: us-east-1\n          AWS_REGION: us-east-1\n          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}\n          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}\n        with:\n          operation: put\n          region: us-east-1\n          table: my-awesome-config\n          item: |\n            { \n              key: \"foo\",\n              value: \"wow\",\n              awesome: true,\n              stars: 12345\n            }\n```\n\nwith File input:\n\n\n```yaml\n# ...\njobs:\n  job:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v2\n      - name: Put DynamoDB Item\n        uses: step-security/dynamodb-actions@v1\n        env:\n          AWS_DEFAULT_REGION: us-east-1\n          AWS_REGION: us-east-1\n          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}\n          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}\n        with:\n          operation: put\n          region: us-east-1\n          table: my-awesome-config\n          file: somewhere/filename.json\n```\n\n\n##### Input\n\n```typescript\ntype PutItemInput = {\n  operation: \"put\";\n  region: string;\n  table: string;\n  item: string; // JSON-serialized item\n} | {\n  operation: \"put\";\n  region: string;\n  table: string;\n  file: string; // JSON file path\n};\n```\n\n##### Output\n\nNone.\n\n\n### Batch Put Item\n\nBatch Put Item to DynamoDB.\n\n##### Example\n\nwith JSON input:\n\n```yaml\n# ...\njobs:\n  job:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v2\n      - name: Put DynamoDB Item\n        uses: step-security/dynamodb-actions@v1\n        env:\n          AWS_DEFAULT_REGION: us-east-1\n          AWS_REGION: us-east-1\n          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}\n          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}\n        with:\n          operation: batch-put\n          region: us-east-1\n          table: my-awesome-config\n          items: |\n            [{ \n              key: \"foo\",\n              value: \"wow\",\n              awesome: true,\n              stars: 12345\n            }, {\n              key: \"bar\",\n              value: \"such\",\n              awesome: false,\n              stars: 1\n            }]\n```\n\nwith File input (Glob):\n\n\u003e You can select multiple files by supplying Glob.\n\u003e\n\u003e For supported Glob patterns, Please refer to [@actions/glob README](https://github.com/actions/toolkit/tree/master/packages/glob#patterns).\n  \n\n```yaml\n# ...\njobs:\n  job:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v2\n      - name: Put DynamoDB Item\n        uses: step-security/dynamodb-actions@v1\n        env:\n          AWS_DEFAULT_REGION: us-east-1\n          AWS_REGION: us-east-1\n          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}\n          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}\n        with:\n          operation: batch-put\n          region: us-east-1\n          table: my-awesome-config\n          files: somewhere/prefix*.json\n```\n\n\n##### Input\n\n```typescript\ntype BatchPutItemInput = {\n  operation: \"batch-put\";\n  region: string;\n  table: string;\n  items: string; // JSON-serialized item array\n} | {\n  operation: \"put\";\n  region: string;\n  table: string;\n  files: string; // Glob to match JSON file paths\n};\n```\n\n##### Output\n\nNone.\n\n\n### Delete Item\n\nDelete Item from DynamoDB\n\n##### Example\n\n```yaml\n# ...\njobs:\n  job:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Delete DynamoDB Item\n        uses: step-security/dynamodb-actions@v1\n        env:\n          AWS_DEFAULT_REGION: us-east-1\n          AWS_REGION: us-east-1\n          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}\n          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}\n        with:\n          operation: delete\n          region: us-east-1\n          table: my-awesome-config\n          key: |\n            { key: \"foo\" }\n```\n\n##### Input\n\n```typescript\ntype DeleteItemInput = {\n  operation: \"delete\";\n  region: string;\n  table: string;\n  key: string; // JSON-serialized key\n}\n```\n\n##### Output\n\nNone\n\n## Using this action with OIDC\n\nYou can securely configure AWS credentials using GitHub’s OpenID Connect (OIDC) provider, eliminating the need to store long-lived credentials as secrets. By configuring your AWS IAM role trust policy to trust GitHub’s OIDC provider, you can assume this role directly within your workflow.\n\n### Prerequisites\n\n1. **AWS IAM Role with OIDC Trust**:  \n   Create or modify an IAM role that trusts the GitHub OIDC provider. For example:\n   ```json\n   {\n     \"Version\": \"2012-10-17\",\n     \"Statement\": [\n       {\n         \"Effect\": \"Allow\",\n         \"Principal\": {\n           \"Federated\": \"arn:aws:iam::\u003cyour_account_id\u003e:oidc-provider/token.actions.githubusercontent.com\"\n         },\n         \"Action\": \"sts:AssumeRoleWithWebIdentity\",\n         \"Condition\": {\n           \"StringEquals\": {\n             \"token.actions.githubusercontent.com:aud\": \"sts.amazonaws.com\",\n             \"token.actions.githubusercontent.com:sub\": \"repo:\u003cyour_org\u003e/\u003cyour_repo\u003e:ref:refs/heads/main\"\n           }\n         }\n       }\n     ]\n   }\n   ```\n2. **GitHub Secrets**:\n    Store the IAM role’s ARN in a GitHub secret, for example ROLE_TO_ASSUME.\n\n### Example OIDC Workflow\nThis example shows how to assume an AWS IAM role using OIDC before running the DynamoDB action.\n\n```yaml\nname: Example OIDC Workflow\non:\n  push:\n    branches: [ main ]\n\njobs:\n  job:\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      id-token: write\n      contents: read\n    steps:\n      # Check out repository\n      - uses: actions/checkout@v1\n      \n      # Configure AWS credentials via OIDC\n      - name: Configure AWS Credentials\n        uses: aws-actions/configure-aws-credentials@v2\n        with:\n          role-to-assume: ${{ secrets.ROLE_TO_ASSUME }}\n          aws-region: us-east-1  # Update as needed\n\n      # Get an item from DynamoDB using assumed credentials\n      - name: Get DynamoDB Item\n        id: config\n        uses: step-security/dynamodb-actions@v1\n        with:\n          operation: get\n          region: us-east-1\n          table: my-awesome-config\n          key: |\n            { key: \"foo\" }\n\n      # Print the full item\n      - name: Print item\n        run: |\n          echo '${{ steps.config.outputs.item }}'\n\n      # Print a specific field using built-in function\n      - name: Print specific field using built-in function\n        run: |\n          echo '${{ fromJson(steps.config.outputs.item).commit }}'\n\n      # Print a specific field using jq\n      - name: Print specific field using jq\n        run: |\n          jq '.commit' \u003c\u003c\u003c '${{ steps.config.outputs.item }}'\n```\n#### Note:\n- `id-token: write` is required for OIDC so that the aws-actions/configure-aws-credentials action can exchange the GitHub OIDC token for temporary AWS credentials.\n- Ensure that the role-to-assume ARN matches the one in your AWS IAM configuration.\n- Update the aws-region and the table name as per your requirements.\n\n\n## FAQ\n\n#### How to select specific field?\n\nUse Github Actions built-in `fromJson` function.\n\nFor example:\n```yaml\n- name: Print specific field\n  run: |\n    echo '${{ fromJson(steps.[id].outputs.item).[field] }}'\n```\n\nAlternatively, You can also use [jq](https://stedolan.github.io/jq/). [Github-hosted runners already have pre-installed jq.](https://help.github.com/en/actions/reference/software-installed-on-github-hosted-runners)\n\nFor example:\n```yaml\n- name: Print specific field\n  run: |\n    jq '.field' \u003c\u003c\u003c echo '${{ steps.[id].outputs.item }}'\n``` \n\n## Wishlist\n\n- Add UpdateItem operation\n- Add conditional writes (e.g. putItem / updateItem)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstep-security%2Fdynamodb-actions","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstep-security%2Fdynamodb-actions","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstep-security%2Fdynamodb-actions/lists"}