Amazon DynamoDB data classification integration

Automate data classification by integrating MineOS with Amazon DynamoDB

How It Works

The Amazon DynamoDB integration lets MineOS discover and classify personal data stored in your DynamoDB tables. MineOS connects to your AWS account through an IAM role that you create and control, so you decide exactly which tables it can read.

Data classification: MineOS scans the tables you choose, across one or more AWS regions, and classifies the personal data it finds in each attribute, including your tables' key attributes.
Read-only access: MineOS only lists, describes and reads tables. It never creates, changes or deletes items.
Sample-based scanning: MineOS reads a sample of items from each table rather than the whole table, so a scan stays light even on large tables.
Protects your workloads: On tables that use provisioned capacity, MineOS uses at most 5% of each table's read capacity, so your own applications keep the rest. On on-demand tables, the cost is limited by the sample size.
Global tables: MineOS scans each global table once, in the first region on your list that holds a replica.

Note: This integration supports data classification only. It does not fulfill privacy requests (get a copy or deletion).

Note: Because MineOS paces itself to protect your read capacity, a first scan of a provisioned table with low read capacity can take several hours.

Before You Start

Make sure your MineOS plan supports integrations.
You need permission to create IAM roles and policies in your AWS account.
Have your 12-digit AWS account ID and the list of AWS regions you want to scan ready.
If any table is encrypted with a customer-managed KMS key, the role also needs permission to decrypt with that key (see step 4b).

Setting Up

To connect the Amazon DynamoDB integration, follow the steps below:

Log in to your MineOS account. On the left sidebar, click Inventory → Data Sources. Click Add Data Source and search for Amazon DynamoDB. Click Add.

[Screenshot needed: Data Sources search results with the Amazon DynamoDB card visible]
Open the newly added Amazon DynamoDB data source from the Inventory list → navigate to the Integrations tab → Request Handling section → select Integration. Keep this page open; you will need the MineOS AWS principal ARN shown here in step 4c.
In a new tab, open the AWS console.
Create an IAM role for MineOS:

a. Go to IAM → Roles → Create role, and choose AWS account as the trusted entity type.

b. Attach a permission policy that allows MineOS to list, describe and scan your tables. We recommend limiting DescribeTable and Scan to the tables MineOS should read. ListTables always needs "Resource": "*"; it returns table names only, never data.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MineDynamoDbListTables",
      "Effect": "Allow",
      "Action": "dynamodb:ListTables",
      "Resource": "*"
    },
    {
      "Sid": "MineDynamoDbReadTables",
      "Effect": "Allow",
      "Action": ["dynamodb:DescribeTable", "dynamodb:Scan"],
      "Resource": "arn:aws:dynamodb:<REGION>:<ACCOUNT_ID>:table/<TABLE_NAME_OR_PREFIX>*"
    },
    {
      "Sid": "MineDynamoDbCustomerManagedKeys",
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:*:<ACCOUNT_ID>:key/*",
      "Condition": {
        "StringLike": { "kms:ViaService": "dynamodb.*.amazonaws.com" }
      }
    }
  ]
}
```
You can set <REGION> to * to cover every region you plan to scan, and list several table ARNs to allow several tables or name prefixes. The kms:Decrypt statement is only needed for tables encrypted with a customer-managed KMS key. To let MineOS read every table in the account, use "Resource": "*" for all three DynamoDB actions instead.

c. Set the role's trust policy so only MineOS can assume it, using an External ID you choose:
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "<MINEOS_PRINCIPAL_ARN>" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": { "sts:ExternalId": "<YOUR_EXTERNAL_ID>" }
      }
    }
  ]
}
```
d. Give the role a name (for example MineOSDynamoDbDiscoveryRole) and create it.

[Screenshot needed: the IAM role's Trust relationships tab showing the MineOS principal and External ID condition]
Back in MineOS, fill in the integration fields:
- External ID: the same value you used in the trust policy.
- Account ID: your 12-digit AWS account ID.
- Role Name: the role's name. If the role has a path, include it (for example service-roles/MineOSDynamoDbDiscoveryRole).
- Regions: the AWS region codes to scan, separated by commas (for example us-east-1,eu-west-1).
- [Optional] Table Name Regex: a regular expression that selects which tables to scan. Leave it blank to scan all tables the role can read.
[Screenshot needed: the Amazon DynamoDB integration form with all fields filled in, External ID masked]
Mark the Scan this source using Data Classifier checkbox, then click Test your integration to verify the connection. MineOS checks that it can assume the role, list tables in each region, and find at least one table that matches your regex.
Click Test & Save.

[Screenshot needed: success confirmation after connecting]

You're done! MineOS has been connected to your Amazon DynamoDB account and will begin the data classification scan.

Troubleshooting

Error: "Failed to assume role … Check the trust policy and External ID"
MineOS could not assume the IAM role. This usually means the role name or path, or the account ID, is wrong, the External ID in MineOS doesn't exactly match the one in the trust policy, or the trust policy doesn't list the MineOS principal ARN. Check the role's Trust relationships tab in AWS, then re-enter the External ID in MineOS and test again.

Error: "No DynamoDB tables match the table name regex … in regions …"
MineOS connected successfully but found no tables to scan. Check that the Regions list includes the regions where your tables live, and that your Table Name Regex matches their names. Leave the regex blank to include every table.

Error: "Access denied listing tables in region …"
The role is missing the dynamodb:ListTables permission. Add it to the role's permission policy with "Resource": "*", since this action can't be limited to specific tables.

Some tables are skipped or not readable during the scan
The connection test doesn't check per-table access, so it can pass even when the role can't describe or scan some tables. MineOS skips those tables and continues with the rest. Make sure the role allows dynamodb:DescribeTable and dynamodb:Scan on every table your regex matches, and add the kms:Decrypt statement for tables that use a customer-managed KMS key.

A region is skipped with "UnrecognizedClientException"
This happens in AWS regions that are disabled by default (for example ap-east-1 or me-south-1). Make sure the region is enabled for your account, then in the IAM console go to Account settings → Security Token Service (STS) → Global endpoint and choose Valid in all AWS Regions.

The scan finishes with no results for a new table
DynamoDB updates a table's item count about every six hours. If a table was created or loaded recently, wait a few hours and run the scan again.

Need Help?

If you need any help with this integration, please contact your Customer Success Manager. They will be happy to assist you!