DynamoDB ARN Generator

DynamoDB ARNs come in two closely related shapes depending on what you’re pointing at: the table itself, or one of its secondary indexes. Both share the same prefix — region, account id, and table/table-name — but the index form tacks on a further /index/index-name segment, and it’s easy to get the ordering wrong or forget the literal word index when hand-typing one. DynamoDB ARN Generator builds either form from three or four fields — region, account id, table name, and an optional index name — so the segment order is always correct.

Leave the index field blank and you get the table-level ARN: arn:aws:dynamodb:region:account:table/table-name, the form used for table-wide actions like dynamodb:PutItem, dynamodb:GetItem, dynamodb:Scan, or dynamodb:UpdateTable in an IAM policy’s Resource field. Fill in an index name and the tool appends /index/index-name, producing the ARN needed when an action is specifically scoped to a global secondary index (GSI) or local secondary index (LSI) — most commonly dynamodb:Query permissions that should only apply through a particular index rather than the base table. DynamoDB doesn’t distinguish GSIs from LSIs in the ARN itself; both use the identical table/name/index/index-name shape, so one field covers either kind.

Like Lambda and EC2, DynamoDB tables are regional, account-scoped resources — the same table name can exist independently in different regions or under different accounts — so both region and account id are required fields here, checked at build time by the shared validator for a real-looking region code and a 12-digit account id. Table and index names are passed through exactly as typed, preserving case, since DynamoDB table and index names are case-sensitive and Users and users genuinely refer to different tables.

The tool is deliberately scoped to the table and index shapes, which cover by far the most common ARN need when writing DynamoDB IAM policies. DynamoDB Streams ARNs use a third, distinct pattern — table/table-name/stream/2026-08-20T00:00:00.000 — where the final segment is a specific timestamp tied to when the stream was enabled, not a name you’d type freely, so building a stream ARN isn’t something a simple name-based form can meaningfully do, and it’s left out of this generator rather than faked with a placeholder timestamp.

Once the required fields are filled, a live preview shows the ARN updating as you type. Clicking Build runs the result through the shared structural validator and reveals a one-click Copy button. A Load sample button fills in a realistic region, account, table, and index name so you can see both the table-only and table+index forms; Clear resets everything. As with every tool in this family, table names, index names, and account ids never leave your browser.

• Four-field form — region, account id, table name, optional index name.
• Table-only or table+index ARN depending on whether an index is supplied.
• Covers both GSIs and LSIs, which share the same ARN shape.
• Case preserved exactly as typed, since DynamoDB names are case-sensitive.
• Live preview that updates as you type.
• Region and account format validation using the shared ARN validator.
• Built on the shared buildARN engine, not a hand-rolled string template.
• Sample region/account/table/index preloaded with one click.
• One-click copy and clear.
• 100% client-side — table and index names never leave the page.

1. Enter a region (e.g. us-east-1) and a 12-digit account id.
2. Type the table name, preserving exact case.
3. Optionally add an index name if you need a GSI or LSI ARN rather than the table ARN.
4. Watch the live preview update as you fill in fields.
5. Click Build to validate and reveal the copy action.
6. Copy the ARN into your IAM policy Resource field.
7. Clear and repeat for the next table.

Example 1 — Table-level ARN. Region us-east-1, account 123456789012, table Users, no index, gives arn:aws:dynamodb:us-east-1:123456789012:table/Users.

Example 2 — Global secondary index ARN. Same fields plus index email-index gives arn:aws:dynamodb:us-east-1:123456789012:table/Users/index/email-index.

Example 3 — Different table in the same account. Table Orders, index status-created-index, gives arn:aws:dynamodb:us-east-1:123456789012:table/Orders/index/status-created-index.

Example 4 — Cross-region table. The same table name Sessions deployed independently in us-east-1 and eu-west-1 produces two distinct ARNs, differing only in region.

Example 5 — Scoping a Query permission to one index. An IAM policy granting dynamodb:Query on arn:aws:dynamodb:us-east-1:123456789012:table/Users/index/email-index allows querying only through that index, not a full table scan.

• Segment order always correct — no more guessing where index goes.
• Covers both table-level and index-level ARNs from one form.
• Preserves case exactly, avoiding a mismatch against case-sensitive table names.
• Catches malformed regions and account ids before they reach a policy document.
• Consistent with the shared ARN engine used across this entire tool family.
• Private — table and index names never leave your browser.