Operations & Cost
Modeling puts data in the table. Operating it — consistent writes, change feeds, expiry, capacity bills, multi-region survival, and recovery — decides whether you trust DynamoDB in production or treat it as the database that throttled at 2 a.m.
This section walks one running scenario: the audit log for a multi-tenant SaaS — immutable "who did what, when" records enterprise buyers ask for. One table, partitioned per tenant:
| PK | SK | actor | action | ip |
|---|---|---|---|---|
| TENANT#acme | EVENT#2026-06-24T09:14Z#a1 | USER#88 | login.success | 203.0.113.7 |
| TENANT#acme | EVENT#2026-06-24T09:15Z#a2 | USER#88 | invoice.export | 203.0.113.7 |
| TENANT#globex | EVENT#2026-06-24T09:15Z#b9 | USER#12 | role.granted | 198.51.100.4 |
Each guide adds one operational concern to this same table.
What you can do after
- Use transactions where all-or-nothing writes matter and know the cancel reasons AWS returns.
- Wire DynamoDB Streams and TTL for append-only audit retention without a nightly delete job.
- Choose on-demand vs provisioned capacity and read the rounding rules that inflate small items.
- Plan global tables and PITR recovery with realistic RPO/RTO expectations.
Reading order
- Cost model and SQL scans — how scan-shaped reads show up on the bill before you operate the audit table.
- Transactions —
TransactWriteItemsfor paired audit + balance updates; idempotency tokens. - Streams — stream consumers that ship audit events to SIEM or warehouse without polling the table.
- TTL — expire old
EVENT#rows automatically; epoch seconds on the TTL attribute. - On-demand vs provisioned — pay per request vs reserved capacity; when each wins for bursty audit traffic.
- Auto scaling — provisioned mode scaling policies.
- Throttling —
ProvisionedThroughputExceededExceptionand on-demand adaptive throttling under spike. - Table size and item count — what AWS reports vs what the table's Overview estimates locally.
- Global tables — multi-region replication for the audit log; write conflicts and reader endpoints.
- Backup and PITR — continuous backups and point-in-time restore windows.
On-demand write request units round up per 1 KB. A 1.1 KB audit event bills two WRUs per write, not one — capacityUnits rounds at the kilobyte boundary. At 100 sustained 1 KB writes per second in us-east-1 on-demand, writes alone land around $164.25 per month before GSIs or streams. The pricing calculator prices your tenant count and event rate.
TTL deletes are free in capacity terms but asynchronous; do not use TTL as a real-time delete mechanism for compliance holds you must prove immediately.
See it in DynoTable
Download DynoTable and inspect the audit table as you read. A table's Overview shows key structure, GSIs, and size/item estimates. The TTL converter turns calendar dates into epoch seconds for TTL attributes — TTL expects seconds, not milliseconds.
DynoTable reads backup/PITR settings if present but does not configure them; control plane changes stay in AWS console or IaC. Same for creating streams or switching capacity mode — the app is data-plane focused.
Price a burst of failed-login writes vs steady audit append in the pricing calculator before you pick on-demand for a spiky security feed.