Question: How do you access DynamoDB from outside AWS?

Answer

You can access DynamoDB from outside AWS through its regional HTTPS API, using an AWS SDK or CLI with an authorized identity. You do not need an EC2 instance or a long-lived IAM user key merely because the client runs elsewhere.

For interactive development, configure an IAM Identity Center profile, sign in and call the table in its Region:

aws sso login --profile development
aws dynamodb list-tables --profile development --region us-east-1

This assumes the profile is already configured and its role permits ListTables. Table reads and writes require their own permissions. An external server can use an appropriate federation or role-based credential flow instead of storing permanent credentials.

Allow outbound HTTPS and check any proxy, firewall and certificate configuration. IAM policies, table resource policies and organization controls still apply. A public service endpoint does not mean the table is publicly readable.

For private connectivity from on-premises, a DynamoDB interface endpoint can be reached over a suitable VPN or Direct Connect path. Gateway endpoints are VPC routing resources and do not provide that same external access. VPC endpoints affect networking, not encryption at rest.

See DynamoDB VPC access and IAM permissions. Request, storage and applicable data-transfer charges still depend on actual usage.

Source: AWS access methods.