Operations & Cost
Modeling puts data in the table. Operating it means consistent writes, change feeds, expiry, capacity bills, multi-Region survival and recovery. Get those right and you can trust DynamoDB in production; get them wrong and it throttles at 2 a.m.
This section walks one running scenario: the audit log for a multi-tenant SaaS, the immutable "who did what, when" records enterprise buyers ask for. One table, partitioned per tenant:
| PK | SK | actor | action | ip |
|---|---|---|---|---|
| TENANT#acme | EVENT#2026-06-24T09:14Z#a1 | USER#88 | login.success | 203.0.113.7 |
| TENANT#acme | EVENT#2026-06-24T09:15Z#a2 | USER#88 | invoice.export | 203.0.113.7 |
| TENANT#globex | EVENT#2026-06-24T09:15Z#b9 | USER#12 | role.granted | 198.51.100.4 |
Most guides add one operational concern to this same table.
What this section teaches you to do
- Use transactions where all-or-nothing writes matter and know the cancel reasons AWS returns.
- Wire DynamoDB Streams and TTL for append-only audit retention without a nightly delete job.
- Choose on-demand vs provisioned capacity from your traffic's average utilization.
- Plan global tables and PITR recovery: what each recovers, and how far back.
Reading order
- Cost model and SQL scans: how scan-shaped reads show up on the bill before you operate the audit table.
- Transactions:
TransactWriteItemsfor an audit event plus its per-tenant counter; idempotency tokens. - Streams: stream consumers that ship audit events to SIEM or warehouse without polling the table.
- TTL: expire old
EVENT#rows automatically; epoch seconds on the TTL attribute. - On-demand vs provisioned: pay per request vs provisioned capacity, the utilization break-even, and a worked bill.
- On-demand throughput, measured: the write and read ceilings of a new on-demand table, and how they grew under load.
- Auto scaling: provisioned mode scaling policies.
- Throttling: the four throttling causes, the exception and metric that name each, and the fix for each.
- Table size and item count: DynamoDB's
six-hour
DescribeTableestimates vs an exactScancount. - Global tables: multi-Region replication for the audit log; last-writer-wins conflicts and the MREC/MRSC consistency modes.
- Backup and PITR: continuous backups and point-in-time restore windows.
On-demand write request units round up per 1 KB, so a 1.1 KB audit event bills two WRUs per write, not one.
At 100 sustained 1 KB writes per second, writes alone come to about $164.25 per month at us-east-1 on-demand list price (730-hour month), before GSIs or streams. The pricing calculator prices your tenant count and event rate.
TTL deletes consume no write capacity in the Region where the item expires; on a global table, each replicated delete bills as a write in every other Region. They are also asynchronous, typically within a few days of expiry.
When a deletion must happen on time and be provable, delete the items yourself
with DeleteItem (or BatchWriteItem) at the deadline and log it, with TTL as
the backstop.
Until an expired item is gone, filter it out at read time on the TTL attribute.
Price your steady audit append in the pricing calculator. For bursts, on-demand absorbs up to double the previous peak instantly; pre-warm anything bigger (on-demand throughput).
See it in DynoTable
Download DynoTable and inspect the audit table as you read. The Settings button in a table's toolbar opens the Table settings dialog: its Overview shows key structure, GSIs, and DynamoDB's size and item-count estimates.
The TTL converter turns calendar dates into epoch seconds for TTL attributes (TTL expects seconds, not milliseconds).
The same dialog switches capacity mode, edits RCU/WCU, sets TTL, turns point-in-time recovery on or off, and adds or removes global-table replicas.
Backups, restores and Streams configuration stay in the AWS console or your infrastructure-as-code.