DynamoDB cannot access stream — stream is not enabled

TL;DR — A consumer (a Lambda event source mapping, a Kinesis Adapter reader, or a raw DescribeStream/GetShardIterator call) tried to read a DynamoDB stream on a table where Streams are turned off, or it used a stale stream ARN from before Streams were re-enabled. Enable DynamoDB Streams on the table and point the consumer at the table's current LatestStreamArn.

What it means

Cannot access stream arn:aws:dynamodb:us-east-1:111122223333:table/Orders/stream/... .
Please ensure the ARN is correct and the stream is enabled.

DynamoDB Streams must be enabled on the table.

DynamoDB Streams is an opt-in feature. A table only has a stream when you set a StreamSpecification with StreamEnabled: true. If a reader — most often a Lambda event source mapping — is wired to a table that has no active stream (or to an ARN that no longer exists), the mapping can't attach and reports that it can't access the stream.

Why it happens

Streams were never enabled on the table, but a consumer expects one.
Streams were disabled and re-enabled — each enable mints a brand-new stream ARN (with a fresh timestamp suffix). A consumer holding the old ARN is reading a disabled stream that stays readable for at most 24 more hours, then its records expire.
Infrastructure-as-code drift — a CDK/CloudFormation/Terraform consumer references a table imported by name/ARN that didn't propagate its stream config, so the tooling thinks Streams are off.
Wrong stream ARN — using the table ARN, or a .../stream/latest placeholder, instead of the real LatestStreamArn.

How to fix it

Enable Streams on the table. Set StreamSpecification { StreamEnabled: true, StreamViewType: NEW_AND_OLD_IMAGES } (or whichever view type your consumer needs) via UpdateTable, the console, or your IaC.
Read the current stream ARN. Call DescribeTable and use the LatestStreamArn field — never a hand-built or cached ARN.
Re-point the consumer at the new ARN after any disable/enable cycle; recreate the Lambda event source mapping if it was bound to the old stream.
Grant read permission — the consumer's role needs dynamodb:DescribeStream, GetRecords, GetShardIterator, and ListStreams on the stream ARN.
Don't confuse table vs stream ARN — the stream ARN ends in /stream/<timestamp>, the table ARN does not.

Need to inspect the table and its stream configuration without the console? The DynoTable desktop app surfaces stream status alongside the table so you can confirm it's on before pointing a reader at it.

Before you retry in DynoTable

Before you attach a Lambda event source mapping, open the table in DynoTable and confirm Streams is enabled and which StreamViewType is set (table details). DynoTable shows stream configuration beside the schema so you do not have to bounce through the AWS console.

After you disable and re-enable Streams, the ARN changes — refresh the table in DynoTable and copy the current stream identity from AWS (LatestStreamArn via CLI/DescribeTable) into the consumer. Use ⌘P to stay on the correct account/region profile. Day-to-day item inspection stays in DynoTable; stream consumers stay in Lambda/Kinesis tooling. The query builder helps verify the table still serves keyed reads after a Streams toggle.

Sources

Change data capture for DynamoDB Streams (verified 2026-07-13)
Process Amazon DynamoDB records with Lambda (verified 2026-07-13)

ResourceNotFoundException — the table or stream ARN doesn't exist at all.
The ARN provided is invalid — a malformed stream ARN.
Learn: DynamoDB Streams

References

Last verified 2026-07-13 against the official AWS documentation linked above.