# Table

Provides a DynamoDB table.

Extends: Construct › Resource › TableBase › Table
Implements: IResource, ITable, IEncryptedResource, IResourceWithPolicy, IResourceWithPolicyV2, IEnvironmentAware, ITableRef, IConstruct, IDependable

- CloudFormation: [`AWS::DynamoDB::Table`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-dynamodb-table.html)
- L1 type: [`CfnTable`](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.CfnTable.html)
- Source: [`aws-dynamodb/lib/table.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-dynamodb/lib/table.ts#L1144)
- Type last changed: v2.227.0 · 21 Nov 2025

## Example

```ts
import * as eventsources from 'aws-cdk-lib/aws-lambda-event-sources';
import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
import { Key } from 'aws-cdk-lib/aws-kms';

declare const fn: lambda.Function;
const table = new dynamodb.Table(this, 'Table', {
  partitionKey: {
    name: 'id',
    type: dynamodb.AttributeType.STRING,
  },
  stream: dynamodb.StreamViewType.NEW_IMAGE,
});
// Your self managed KMS key
const myKey = Key.fromKeyArn(
  this,
  'SourceBucketEncryptionKey',
  'arn:aws:kms:us-east-1:123456789012:key/<key-id>',
);

fn.addEventSource(new eventsources.DynamoEventSource(table, {
  startingPosition: lambda.StartingPosition.LATEST,
  filters: [lambda.FilterCriteria.filter({ eventName: lambda.FilterRule.isEqual('INSERT') })],
  filterEncryption: myKey,
}));
```

## Initializer

```ts
new Table(scope: Construct, id: string, props: TableProps)
```

## Construct Props

- `billingMode`: [BillingMode](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.BillingMode.html) — Specify how you are charged for read and write throughput and how you manage capacity.

  **Default:** PROVISIONED if `replicationRegions` is not specified, PAY_PER_REQUEST otherwise

- `contributorInsightsEnabled`: boolean = false — use `contributorInsightsSpecification instead

- `contributorInsightsSpecification`: [ContributorInsightsSpecification](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.ContributorInsightsSpecification.html) — Whether CloudWatch contributor insights is enabled and what mode is selected.

  **Default:** contributor insights is not enabled

- `deletionProtection`: boolean = false — Enables deletion protection for the table.

- `encryption`: [TableEncryption](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.TableEncryption.html) — Whether server-side encryption with an AWS managed customer master key is enabled.

  **Default:** The table is encrypted with an encryption key managed by DynamoDB, and you are not charged any fee for using it.

  This property cannot be set if `serverSideEncryption` is set.

  > **NOTE**: if you set this to `CUSTOMER_MANAGED` and `encryptionKey` is not
  > specified, the key that the Tablet generates for you will be created with
  > default permissions. If you are using CDKv2, these permissions will be
  > sufficient to enable the key for use with DynamoDB tables.  If you are
  > using CDKv1, make sure the feature flag
  > `@aws-cdk/aws-kms:defaultKeyPolicies` is set to `true` in your `cdk.json`.

- `encryptionKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) — External KMS key to use for table encryption.

  **Default:** If `encryption` is set to `TableEncryption.CUSTOMER_MANAGED` and this property is undefined, a new KMS key will be created and associated with this table. If `encryption` and this property are both undefined, then the table is encrypted with an encryption key managed by DynamoDB, and you are not charged any fee for using it.

  This property can only be set if `encryption` is set to `TableEncryption.CUSTOMER_MANAGED`.

- `importSource`: [ImportSourceSpecification](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.ImportSourceSpecification.html) — The properties of data being imported from the S3 bucket source to the table.

  **Default:** no data import from the S3 bucket

- `kinesisPrecisionTimestamp`: [ApproximateCreationDateTimePrecision](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.ApproximateCreationDateTimePrecision.html) — Kinesis Data Stream approximate creation timestamp precision.

  **Default:** ApproximateCreationDateTimePrecision.MICROSECOND

- `kinesisStream`: [IStream](/cdk/api/v2/docs/aws-cdk-lib.aws_kinesis.IStream.html) — Kinesis Data Stream to capture item-level changes for the table.

  **Default:** no Kinesis Data Stream

- `maxReadRequestUnits`: number — The maximum read request units for the table.

  **Default:** on-demand throughput is disabled

  Careful if you add Global Secondary Indexes, as
  those will share the table's maximum on-demand throughput.

  Can only be provided if billingMode is PAY_PER_REQUEST.

- `maxWriteRequestUnits`: number — The write request units for the table.

  **Default:** on-demand throughput is disabled

  Careful if you add Global Secondary Indexes, as
  those will share the table's maximum on-demand throughput.

  Can only be provided if billingMode is PAY_PER_REQUEST.

- `partitionKey`: [Attribute](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.Attribute.html) — Partition key attribute definition.

  **Default:** exactly one of `partitionKey` and `partitionKeys` must be specified.

  If a single field forms the partition key, you can use this field.  Use the
  `partitionKeys` field if the partition key is a multi-attribute key (consists of
  multiple fields).

- `pointInTimeRecovery`: boolean — use `pointInTimeRecoverySpecification` instead

  **Default:** false - point in time recovery is not enabled.

- `pointInTimeRecoverySpecification`: [PointInTimeRecoverySpecification](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.PointInTimeRecoverySpecification.html) — Whether point-in-time recovery is enabled and recoveryPeriodInDays is set.

  **Default:** point in time recovery is not enabled.

- `readCapacity`: number = 5 — The read capacity for the table.

  Careful if you add Global Secondary Indexes, as
  those will share the table's provisioned throughput.

  Can only be provided if billingMode is Provisioned.

- `removalPolicy`: [RemovalPolicy](/cdk/api/v2/docs/aws-cdk-lib.RemovalPolicy.html) = RemovalPolicy.RETAIN — The removal policy to apply to the DynamoDB Table.

- `replicaRemovalPolicy`: [RemovalPolicy](/cdk/api/v2/docs/aws-cdk-lib.RemovalPolicy.html) — The removal policy to apply to the DynamoDB replica tables.

  **Default:** undefined - use DynamoDB Table's removal policy

- `replicationRegions`: string[] — Regions where replica tables will be created.

  **Default:** no replica tables are created

- `replicationTimeout`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.minutes(30) — The timeout for a table replication operation in a single region.

- `resourcePolicy`: [PolicyDocument](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.PolicyDocument.html) — Resource policy to assign to table.

  **Default:** No resource policy statement

- `sortKey`: [Attribute](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.Attribute.html) — Sort key attribute definition.

  **Default:** no sort key

  If a single field forms the sort key, you can use this field.  Use the
  `sortKeys` field if the sort key is a multi-attribute key (consists of multiple
  fields).

- `stream`: [StreamViewType](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.StreamViewType.html) — When an item in the table is modified, StreamViewType determines what information is written to the stream for this table.

  **Default:** streams are disabled unless `replicationRegions` is specified

- `tableClass`: [TableClass](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.TableClass.html) = STANDARD — Specify the table class.

- `tableName`: string = <generated> — Enforces a particular physical table name.

- `timeToLiveAttribute`: string — The name of TTL attribute.

  **Default:** TTL is disabled

- `waitForReplicationToFinish`: boolean = true — [WARNING: Use this flag with caution, misusing this flag may cause deleting existing replicas, refer to the detailed documentation for more information] Indicates whether CloudFormation stack waits for replication to finish.

  If set to false, the CloudFormation resource will mark the resource as
  created and replication will be completed asynchronously. This property is
  ignored if replicationRegions property is not set.

  WARNING:
  DO NOT UNSET this property if adding/removing multiple replicationRegions
  in one deployment, as CloudFormation only supports one region replication
  at a time. CDK overcomes this limitation by waiting for replication to
  finish before starting new replicationRegion.

  If the custom resource which handles replication has a physical resource
  ID with the format `region` instead of `tablename-region` (this would happen
  if the custom resource hasn't received an event since v1.91.0), DO NOT SET
  this property to false without making a change to the table name.
  This will cause the existing replicas to be deleted.

- `warmThroughput`: [WarmThroughput](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.WarmThroughput.html) — Specify values to pre-warm you DynamoDB Table Warm Throughput feature is not available for Global Table replicas using the `Table` construct.

  **Default:** warm throughput is not configured

  To enable Warm Throughput, use the `TableV2` construct instead.

- `writeCapacity`: number = 5 — The write capacity for the table.

  Careful if you add Global Secondary Indexes, as
  those will share the table's provisioned throughput.

  Can only be provided if billingMode is Provisioned.

## Properties

- `encryptionKey`: [IKey](/cdk/api/v2/docs/aws-cdk-lib.aws_kms.IKey.html) — KMS encryption key, if this table uses a customer-managed encryption key.

- `env`: [ResourceEnvironment](/cdk/api/v2/docs/aws-cdk-lib.interfaces.ResourceEnvironment.html) — The environment this resource belongs to.

  For resources that are created and managed in a Stack (those created by
  creating new class instances like `new Role()`, `new Bucket()`, etc.), this
  is always the same as the environment of the stack they belong to.

  For referenced resources (those obtained from referencing methods like
  `Role.fromRoleArn()`, `Bucket.fromBucketName()`, etc.), they might be
  different than the stack they were imported into.

- `grants`: [TableGrants](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.TableGrants.html) — Grant a predefined set of permissions on this Table.

- `node`: [Node](/cdk/api/v2/docs/constructs.Node.html) — The tree node.

- `PROPERTY_INJECTION_ID`: string (static) — Uniquely identifies this class.

- `regions`: string[] — Additional regions other than the main one that this table is replicated to.

- `resourcePolicy`: [PolicyDocument](/cdk/api/v2/docs/aws-cdk-lib.aws_iam.PolicyDocument.html) — Resource policy to assign to DynamoDB Table.

  **Default:** No resource policy statements are added to the created table.

- `stack`: [Stack](/cdk/api/v2/docs/aws-cdk-lib.Stack.html) — The stack in which this resource is defined.

- `streamGrants`: [StreamGrants](/cdk/api/v2/docs/aws-cdk-lib.aws_dynamodb.StreamGrants.html) — Grant a predefined set of permissions on this Table's Stream, if present.

  Will throw if the Table has not been configured for streaming.

- `tableArn`: string — Arn of the dynamodb table.

- `tableName`: string — Table name of the dynamodb table.

- `tableRef`: [TableReference](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_dynamodb.TableReference.html) — A reference to a Table resource.

- `tableStreamArn`: string — ARN of the table's stream, if there is one.

## Methods

- `addGlobalSecondaryIndex(props: GlobalSecondaryIndexProps): void` — Add a global secondary index of table.

  **Parameters**

  - `props` — the property of global secondary index.

- `addLocalSecondaryIndex(props: LocalSecondaryIndexProps): void` — Add a local secondary index of table.

  **Parameters**

  - `props` — the property of local secondary index.

- `addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult` — Adds a statement to the resource policy associated with this table.

  A resource policy will be automatically created upon the first call to `addToResourcePolicy`.

  Note that this does not work with imported tables.

  **Parameters**

  - `statement` — The policy statement to add.

- `applyCrossStackReferenceStrength(strength: ReferenceStrength): void` — Override the cross-stack reference strength for this resource.

  When set, any cross-stack reference to this resource will use the specified
  mechanism instead of the global default determined by the
  `@aws-cdk/core:defaultCrossStackReferences` context key. This is useful for
  selectively weakening specific references to avoid the "deadly embrace" problem
  without changing the app-wide default.

  **Parameters**

  - `strength` — - The reference strength to use for this resource.

- `applyRemovalPolicy(policy: RemovalPolicy): void` — Apply the given removal policy to this resource.

  The Removal Policy controls what happens to this resource when it stops
  being managed by CloudFormation, either because you've removed it from the
  CDK application or because you've made a change that requires the resource
  to be replaced.

  The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
  account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).

- `autoScaleGlobalSecondaryIndexReadCapacity(indexName: string, props: EnableScalingProps): IScalableTableAttribute` — Enable read capacity scaling for the given GSI.

  **Returns:** An object to configure additional AutoScaling settings for this attribute

- `autoScaleGlobalSecondaryIndexWriteCapacity(indexName: string, props: EnableScalingProps): IScalableTableAttribute` — Enable write capacity scaling for the given GSI.

  **Returns:** An object to configure additional AutoScaling settings for this attribute

- `autoScaleReadCapacity(props: EnableScalingProps): IScalableTableAttribute` — Enable read capacity scaling for this table.

  **Returns:** An object to configure additional AutoScaling settings

- `autoScaleWriteCapacity(props: EnableScalingProps): IScalableTableAttribute` — Enable write capacity scaling for this table.

  **Returns:** An object to configure additional AutoScaling settings for this attribute

- `fromTableArn(scope: Construct, id: string, tableArn: string): ITable` (static) — Creates a Table construct that represents an external table via table arn.

  **Parameters**

  - `scope` — The parent creating construct (usually `this`).
  - `id` — The construct's name.
  - `tableArn` — The table's ARN.

- `fromTableAttributes(scope: Construct, id: string, attrs: TableAttributes): ITable` (static) — Creates a Table construct that represents an external table.

  **Parameters**

  - `scope` — The parent creating construct (usually `this`).
  - `id` — The construct's name.
  - `attrs` — A `TableAttributes` object.

- `fromTableName(scope: Construct, id: string, tableName: string): ITable` (static) — Creates a Table construct that represents an external table via table name.

  **Parameters**

  - `scope` — The parent creating construct (usually `this`).
  - `id` — The construct's name.
  - `tableName` — The table's name.

- `grant(grantee: IGrantable, ...actions: string[]): Grant` — Adds an IAM policy statement associated with this table to an IAM principal's policy.

  If `encryptionKey` is present, appropriate grants to the key needs to be added
  separately using the `table.encryptionKey.grant*` methods.
  [disable-awslint:no-grants]

  **Parameters**

  - `grantee` — The principal (no-op if undefined).
  - `actions` — The set of actions to allow (i.e. "dynamodb:PutItem", "dynamodb:GetItem", ...).

- `grantFullAccess(grantee: IGrantable): Grant` — Permits all DynamoDB operations ("dynamodb:*") to an IAM principal.

  Appropriate grants will also be added to the customer-managed KMS key
  if one was configured.

  The use of this method is discouraged. Please use `grants.fullAccess()` instead.

  [disable-awslint:no-grants]

  **Parameters**

  - `grantee` — The principal to grant access to.

- `grantOnKey(grantee: IGrantable, ...actions: string[]): GrantOnKeyResult` — Gives permissions to a grantable entity to perform actions on the encryption key.

- `grantReadData(grantee: IGrantable): Grant` — Permits an IAM principal all data read operations from this table: BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan, DescribeTable.

  Appropriate grants will also be added to the customer-managed KMS key
  if one was configured.

  The use of this method is discouraged. Please use `grants.readData()` instead.

  [disable-awslint:no-grants]

  **Parameters**

  - `grantee` — The principal to grant access to.

- `grantReadWriteData(grantee: IGrantable): Grant` — Permits an IAM principal to all data read/write operations to this table.

  BatchGetItem, GetRecords, GetShardIterator, Query, GetItem, Scan,
  BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable

  Appropriate grants will also be added to the customer-managed KMS key
  if one was configured.

  The use of this method is discouraged. Please use `grants.readWriteData()` instead.

  [disable-awslint:no-grants]

  **Parameters**

  - `grantee` — The principal to grant access to.

- `grantStream(grantee: IGrantable, ...actions: string[]): Grant` — Adds an IAM policy statement associated with this table's stream to an IAM principal's policy.

  If `encryptionKey` is present, appropriate grants to the key needs to be added
  separately using the `table.encryptionKey.grant*` methods.

  The use of this method is discouraged. Please use `streamGrants.stream()` instead.

  [disable-awslint:no-grants]

  **Parameters**

  - `grantee` — The principal (no-op if undefined).
  - `actions` — The set of actions to allow (i.e. "dynamodb:DescribeStream", "dynamodb:GetRecords", ...).

- `grantStreamRead(grantee: IGrantable): Grant` — Permits an IAM principal all stream data read operations for this table's stream: DescribeStream, GetRecords, GetShardIterator, ListStreams.

  Appropriate grants will also be added to the customer-managed KMS key
  if one was configured.

  The use of this method is discouraged. Please use `streamGrants.streamRead()` instead.

  [disable-awslint:no-grants]

  **Parameters**

  - `grantee` — The principal to grant access to.

- `grantTableListStreams(grantee: IGrantable): Grant` — Permits an IAM Principal to list streams attached to current dynamodb table.

  The use of this method is discouraged. Please use `streamGrants.tableListStreams()` instead.

  [disable-awslint:no-grants]

  **Parameters**

  - `grantee` — The principal (no-op if undefined).

- `grantWriteData(grantee: IGrantable): Grant` — Permits an IAM principal all data write operations to this table: BatchWriteItem, PutItem, UpdateItem, DeleteItem, DescribeTable.

  Appropriate grants will also be added to the customer-managed KMS key
  if one was configured.

  The use of this method is discouraged. Please use `grants.writeData()` instead.

  [disable-awslint:no-grants]

  **Parameters**

  - `grantee` — The principal to grant access to.

- `isConstruct(x: any): boolean` (static) — Checks if `x` is a construct.

  Use this method instead of `instanceof` to properly detect `Construct`
  instances, even when the construct library is symlinked.

  Explanation: in JavaScript, multiple copies of the `constructs` library on
  disk are seen as independent, completely different libraries. As a
  consequence, the class `Construct` in each copy of the `constructs` library
  is seen as a different class, and an instance of one class will not test as
  `instanceof` the other class. `npm install` will not create installations
  like this, but users may manually symlink construct libraries together or
  use a monorepo tool: in those cases, multiple copies of the `constructs`
  library can be accidentally installed, and `instanceof` will behave
  unpredictably. It is safest to avoid using `instanceof`, and using
  this type-testing method instead.

  **Parameters**

  - `x` — Any object.

  **Returns:** true if `x` is an object created from a class which extends `Construct`.

- `isOwnedResource(construct: IConstruct): boolean` (static) — Returns true if the construct was created by CDK, and false otherwise.

- `isResource(construct: IConstruct): boolean` (static) — Check whether the given construct is a Resource.

- `metric(metricName: string, props?: MetricOptions): Metric` — Return the given named metric for this Table.

  By default, the metric will be calculated as a sum over a period of 5 minutes.
  You can customize this by using the `statistic` and `period` properties.

- `metricConditionalCheckFailedRequests(props?: MetricOptions): Metric` — Metric for the conditional check failed requests this table.

  By default, the metric will be calculated as a sum over a period of 5 minutes.
  You can customize this by using the `statistic` and `period` properties.

- `metricConsumedReadCapacityUnits(props?: MetricOptions): Metric` — Metric for the consumed read capacity units this table.

  By default, the metric will be calculated as a sum over a period of 5 minutes.
  You can customize this by using the `statistic` and `period` properties.

- `metricConsumedWriteCapacityUnits(props?: MetricOptions): Metric` — Metric for the consumed write capacity units this table.

  By default, the metric will be calculated as a sum over a period of 5 minutes.
  You can customize this by using the `statistic` and `period` properties.

- `metricSuccessfulRequestLatency(props?: MetricOptions): Metric` — Metric for the successful request latency this table.

  By default, the metric will be calculated as an average over a period of 5 minutes.
  You can customize this by using the `statistic` and `period` properties.

- `metricSystemErrors(props?: MetricOptions): Metric` — use `metricSystemErrorsForOperations`.

- `metricSystemErrorsForOperations(props?: SystemErrorsForOperationsMetricOptions): IMetric` — Metric for the system errors this table.

  This will sum errors across all possible operations.
  Note that by default, each individual metric will be calculated as a sum over a period of 5 minutes.
  You can customize this by using the `statistic` and `period` properties.

- `metricThrottledRequests(props?: MetricOptions): Metric` — Do not use this function. It returns an invalid metric. Use `metricThrottledRequestsForOperation` instead.

  Default: sum over 5 minutes

- `metricThrottledRequestsForOperation(operation: string, props?: MetricOptions): Metric` — How many requests are throttled on this table, for the given operation.

  Default: sum over 5 minutes

- `metricThrottledRequestsForOperations(props?: OperationsMetricOptions): IMetric` — How many requests are throttled on this table.

  This will sum errors across all possible operations.
  Note that by default, each individual metric will be calculated as a sum over a period of 5 minutes.
  You can customize this by using the `statistic` and `period` properties.

- `metricUserErrors(props?: MetricOptions): Metric` — Metric for the user errors.

  Note that this metric reports user errors across all
  the tables in the account and region the table resides in.

  By default, the metric will be calculated as a sum over a period of 5 minutes.
  You can customize this by using the `statistic` and `period` properties.

- `schema(indexName?: string): SchemaOptions` — - use `schemaV2()` instead

  **Returns:** Schema of table or index.

- `schemaV2(indexName?: string): KeySchema` — Get schema attributes of table or index.

  **Returns:** Schema of table or index.

- `toString(): string` — Returns a string representation of this construct.

- `with(...mixins: IMixin[]): IConstruct` — Applies one or more mixins to this construct.

  Mixins are applied in order. The list of constructs is captured at the
  start of the call, so constructs added by a mixin will not be visited.
  Use multiple `with()` calls if subsequent mixins should apply to added
  constructs.