DynamoDB Streams — The ARN provided is invalid

TL;DR — A Streams API call (DescribeStream, GetShardIterator, GetRecords) got a stream ARN that isn't a well-formed, current stream descriptor — usually a /stream/latest placeholder, a table ARN by mistake, or a stale/truncated ARN. Fetch the real ARN from DescribeTable's LatestStreamArn and pass it verbatim.

What it means

ValidationException: The ARN provided is invalid

A DynamoDB stream ARN has a strict shape:

arn:aws:dynamodb:us-west-2:111122223333:table/TestTable/stream/2015-05-11T21:21:33.291

The trailing /stream/<ISO-8601 timestamp> is a specific stream descriptor, not a symbolic name. The Streams endpoint rejects anything that doesn't parse as a valid, existing stream ARN with The ARN provided is invalid.

Why it happens

A /stream/latest (or similar) placeholder — some tools and local emulators accept it, but real DynamoDB requires the concrete timestamped descriptor.
Passing the table ARN (.../table/TestTable) where a stream ARN was expected.
A stale ARN — Streams was disabled and re-enabled, so the table's current stream has a new descriptor; the old stream stays readable for only 24 hours after being disabled, then its records expire.
A hand-built or truncated ARN — wrong region, wrong account, missing the /stream/... segment, or an extra whitespace/newline.
Region mismatch — the Streams client is configured for a different region than the ARN encodes.

How to fix it

Get the ARN from the source of truth. Call DescribeTable and read Table.LatestStreamArn; use that exact string.
Never synthesize the ARN by hand or use /stream/latest — the timestamp segment is assigned by DynamoDB and can't be guessed.
Use the DynamoDB Streams endpoint, not the main DynamoDB endpoint, for DescribeStream/GetShardIterator/GetRecords.
Match the region of the client to the region in the ARN.
Re-fetch after any Streams toggle — a disable/enable cycle creates a brand-new stream with a different descriptor, so the previous ARN no longer points at the live stream.
Trim whitespace when copying. A trailing newline on an otherwise valid ARN still fails validation.

Spot this in DynoTable

DynoTable shows each table's LatestStreamArn in the table metadata panel — copy it verbatim instead of hand-building /stream/latest placeholders. Open the table with ⌘K and expand Stream details before you wire a Lambda or KCL consumer.

Use the Query Builder to confirm the table is reachable with the same profile that owns the stream. Switch Regions with ⌘P; Test Connection on Settings → Profiles must match the ARN's Region. See Connect to AWS and Install. Never hand-build the /stream/<timestamp> suffix — copy LatestStreamArn from DescribeTable every time. A table ARN (.../table/Name) is not a stream ARN and triggers the same validation failure.

Sources

Change data capture for DynamoDB Streams (verified 2026-07-13)
GetShardIterator — Amazon DynamoDB Streams API Reference (verified 2026-07-13)

Cannot access stream — stream is not enabled — Streams is off or the ARN points at a gone stream.
ValidationException — parameter values were invalid
Learn: DynamoDB Streams

References

Last verified 2026-07-13 against the official AWS documentation linked above.