DynamoDB cannot access stream — stream is not enabled

TL;DR — A consumer (a Lambda event source mapping, a Kinesis Adapter reader, or a raw DescribeStream/GetShardIterator call) tried to read a DynamoDB stream on a table where Streams are turned off, or it used a stale stream ARN from before Streams were re-enabled. Enable DynamoDB Streams on the table and point the consumer at the table's current LatestStreamArn.

What it means

Cannot access stream arn:aws:dynamodb:us-east-1:111122223333:table/Orders/stream/... .
Please ensure the ARN is correct and the stream is enabled.

DynamoDB Streams must be enabled on the table.

DynamoDB Streams is an opt-in feature. A table only has a stream when you set a StreamSpecification with StreamEnabled: true. If a reader — most often a Lambda event source mapping — is wired to a table that has no active stream (or to an ARN that no longer exists), the mapping can't attach and reports that it can't access the stream.

Why it happens

• Streams were never enabled on the table, but a consumer expects one.
• Streams were disabled and re-enabled — each enable mints a brand-new stream ARN (with a fresh timestamp suffix). A consumer holding the old ARN can no longer read it.
• Infrastructure-as-code drift — a CDK/CloudFormation/Terraform consumer references a table imported by name/ARN that didn't propagate its stream config, so the tooling thinks Streams are off.
• Wrong stream ARN — using the table ARN, or a .../stream/latest placeholder, instead of the real LatestStreamArn.

How to fix it

1. Enable Streams on the table. Set StreamSpecification { StreamEnabled: true, StreamViewType: NEW_AND_OLD_IMAGES } (or whichever view type your consumer needs) via UpdateTable, the console, or your IaC.
2. Read the current stream ARN. Call DescribeTable and use the LatestStreamArn field — never a hand-built or cached ARN.
3. Re-point the consumer at the new ARN after any disable/enable cycle; recreate the Lambda event source mapping if it was bound to the old stream.
4. Grant read permission — the consumer's role needs dynamodb:DescribeStream, GetRecords, GetShardIterator, and ListStreams on the stream ARN.
5. Don't confuse table vs stream ARN — the stream ARN ends in /stream/<timestamp>, the table ARN does not.

Need to inspect the table and its stream configuration without the console? The DynoTable desktop app surfaces stream status alongside the table so you can confirm it's on before pointing a reader at it.

Related errors

• ResourceNotFoundException — the table or stream ARN doesn't exist at all.
• The ARN provided is invalid — a malformed stream ARN.
• Learn: DynamoDB Streams