Question: How to access DynamoDB from EC2?

Answer

Attach an IAM role to the EC2 instance and use an AWS SDK or AWS CLI to call the regional DynamoDB endpoint. The SDK's default credential chain retrieves temporary credentials from the instance role; you do not need to store access keys on the machine.

Create a role trusted by EC2, grant only the DynamoDB actions and table or index ARNs the application needs, and attach it through an instance profile. Configure the application for the table's Region.

import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
import { DynamoDBDocumentClient, GetCommand } from "@aws-sdk/lib-dynamodb";

const ddb = DynamoDBDocumentClient.from(
  new DynamoDBClient({ region: "us-east-1" })
);
const { Item } = await ddb.send(new GetCommand({
  TableName: "Orders", Key: { pk: "ORDER#42" },
}));

This example assumes a String partition key named pk. Ensure outbound HTTPS can reach DynamoDB. In a private subnet, a DynamoDB gateway endpoint provides a route without a NAT gateway; its route tables and endpoint policy must allow the request. An interface endpoint has different network and security-group requirements.

If access fails, check the instance identity, Region, IAM policy, endpoint policy and table resource policy. See DynamoDB access control and VPC connectivity.

Source: AWS EC2 IAM roles.