Amazon DynamoDB SQL Connector

Sink: Batch Sink: Streaming Append & Upsert Mode

The DynamoDB connector allows for writing data into Amazon DynamoDB.

Dependencies

There is no connector (yet) available for Flink version 1.20.

How to create a DynamoDB table

Follow the instructions from the Amazon DynamoDB Developer Guide to set up a DynamoDB table. The following example shows how to create a table backed by a DynamoDB table with minimum required options:

  1. CREATE TABLE DynamoDbTable (
  2. `user_id` BIGINT,
  3. `item_id` BIGINT,
  4. `category_id` BIGINT,
  5. `behavior` STRING
  6. )
  7. WITH (
  8. 'connector' = 'dynamodb',
  9. 'table-name' = 'user_behavior',
  10. 'aws.region' = 'us-east-2'
  11. );

Connector Options

OptionRequiredDefaultTypeDescription
Common Options
connector
required(none)StringSpecify what connector to use. For DynamoDB use ‘dynamodb’.
table-name
required(none)StringName of the DynamoDB table to use.
aws.region
required(none)StringThe AWS region where the DynamoDB table is defined.
aws.endpoint
optional(none)StringThe AWS endpoint for DynamoDB.
aws.trust.all.certificates
optionalfalseBooleanIf true accepts all SSL certificates.
Authentication Options
aws.credentials.provider
optionalAUTOStringA credentials provider to use when authenticating against the Kinesis endpoint. See Authentication for details.
aws.credentials.basic.accesskeyid
optional(none)StringThe AWS access key ID to use when setting credentials provider type to BASIC.
aws.credentials.basic.secretkey
optional(none)StringThe AWS secret key to use when setting credentials provider type to BASIC.
aws.credentials.profile.path
optional(none)StringOptional configuration for profile path if credential provider type is set to be PROFILE.
aws.credentials.profile.name
optional(none)StringOptional configuration for profile name if credential provider type is set to be PROFILE.
aws.credentials.role.arn
optional(none)StringThe role ARN to use when credential provider type is set to ASSUME_ROLE or WEB_IDENTITY_TOKEN.
aws.credentials.role.sessionName
optional(none)StringThe role session name to use when credential provider type is set to ASSUME_ROLE or WEB_IDENTITY_TOKEN.
aws.credentials.role.externalId
optional(none)StringThe external ID to use when credential provider type is set to ASSUME_ROLE.
aws.credentials.role.provider
optional(none)StringThe credentials provider that provides credentials for assuming the role when credential provider type is set to ASSUME_ROLE. Roles can be nested, so this value can again be set to ASSUME_ROLE
aws.credentials.webIdentityToken.file
optional(none)StringThe absolute path to the web identity token file that should be used if provider type is set to WEB_IDENTITY_TOKEN.
aws.credentials.custom.class
required only if credential provider is set to CUSTOM(none)StringThe full path (in Java package notation) to the user provided class to use if credential provider type is set to be CUSTOM e.g. org.user_company.auth.CustomAwsCredentialsProvider.
Sink Options
sink.batch.max-size
optional25IntegerMaximum batch size of elements to be written to DynamoDB.
sink.requests.max-inflight
optional50IntegerMaximum number of parallel batch requests to DynamoDB.
sink.requests.max-buffered
optional10000StringSize of input buffer before applying backpressure to upstream job graph
sink.flush-buffer.timeout
optional5000LongThreshold time in ms for an element to be in a buffer before flushing.
sink.fail-on-error
optionalfalseBooleanFlag used for retrying failed requests. If set any request failure will not be retried and will fail the job.
HTTP Client Options
sink.http-client.max-concurrency
optional10000IntegerMaximum number of allowed concurrent requests by the HTTP client.
sink.http-client.read-timeout
optional360000IntegerTimeout for each read to the underlying socket.

Authorization

Make sure to create an appropriate IAM policy to allow writing to the DynamoDB table.

Authentication

Depending on your deployment you would choose an appropriate Credentials Provider to allow access to DynamoDB. By default, the AUTO Credentials Provider is used. If the access key ID and secret key are set in the deployment configuration, this results in using the BASIC provider.

A specific AWSCredentialsProvider can be optionally set using the aws.credentials.provider setting. Supported values are:

  • AUTO - Use the default AWS Credentials Provider chain that searches for credentials in the following order: ENV_VARS, SYS_PROPS, WEB_IDENTITY_TOKEN, PROFILE, and EC2/ECS credentials provider.
  • BASIC - Use access key ID and secret key supplied as configuration.
  • ENV_VAR - Use AWS_ACCESS_KEY_ID & AWS_SECRET_ACCESS_KEY environment variables.
  • SYS_PROP - Use Java system properties aws.accessKeyId and aws.secretKey.
  • PROFILE - Use an AWS credentials profile to create the AWS credentials.
  • ASSUME_ROLE - Create AWS credentials by assuming a role. The credentials for assuming the role must be supplied.
  • WEB_IDENTITY_TOKEN - Create AWS credentials by assuming a role using Web Identity Token.
  • CUSTOM - Provide a custom class that implements the interface AWSCredentialsProvider and has a constructor MyCustomClass(java.util.Properties config). All connector properties will be passed down to this custom credential provider class via the constructor.

Sink Partitioning

The DynamoDB sink supports client side deduplication of data via the PARTITIONED BY clause. You can specify a list of partition keys, the sink will only send the latest record for each composite key within a batch. For example:

  1. CREATE TABLE DynamoDbTable (
  2. `user_id` BIGINT,
  3. `item_id` BIGINT,
  4. `category_id` BIGINT,
  5. `behavior` STRING
  6. ) PARTITIONED BY ( user_id )
  7. WITH (
  8. 'connector' = 'dynamodb',
  9. 'table-name' = 'user_behavior',
  10. 'aws.region' = 'us-east-2'
  11. );

Notice

The current implementation of the DynamoDB SQL connector is write-only and doesn’t provide an implementation for source queries. Queries similar to:

  1. SELECT * FROM DynamoDbTable;

should result in an error similar to

  1. Connector dynamodb can only be used as a sink. It cannot be used as a source.