• Task
  • Version · 6.0
  • Create

Connect Liquibase with Amazon DynamoDB Secure

Last updated: October 26, 2026

Amazon DynamoDB is a fully managed NoSQL database service.

Note: In Liquibase Secure 5.x, Amazon DynamoDB support is included by default through the bundled Liquibase AWS extension. You do not need to install a separate extension.

Before you begin

  • Install Liquibase

  • Ensure you have Java installed. Liquibase requires Java to run. If you used the Liquibase Installer, Java is included automatically. Otherwise, you must install Java manually.

Procedure

1

(Maven users only) Configure Maven

If you're running Liquibase using the Maven plugin using mvn liquibase: update, installing the extension with Maven ensures the right files are available and everything works together automatically. You can manage these extensions by adding them as dependencies in your project’s pom.xml file. Configuring Maven this way ensures that the necessary JAR files are retrieved from Maven Central during the build phase.

2

Implement Amazon DynamoDB

1. Configure your AWS keys as local environment variables or in your AWS configuration files. You can use these secure credentials instead of a traditional username and password. You must set the following keys:

  • AWS_ACCESS_KEY_ID

  • AWS_SECRET_ACCESS_KEY

  • AWS_SESSION_TOKEN (optional)

Note: The Liquibase DynamoDB extension automatically detects the value of AWS_REGION from your database connection URL, so you don't have to specify it in your config file (~/.aws/config).

In your shared credentials file (~/.aws/credentials), you can use temporary values from your AWS access portal. For example:

loading

2. Ensure your AWS user account has Identity and Access Management (IAM) permissions to make the following API actions:

loading

You may want to add more permissions. For a list of permission keys, see Actions, resources, and condition keys for Amazon DynamoDB.

3. (Optional) If you want to make operations with the sseSpecification feature, you must also have the following permissions:

"kms:DescribeKey",
"kms:CreateGrant"

4. (Optional) If you want to use AWS Secrets Manager, you must also have the following permissions:

"secretsmanager:DescribeSecret",
"secretsmanager:GetSecretValue",
"secretsmanager:ListSecrets",
"secretsmanager:ListSecretVersionIds"

5. (Optional) If you want to use changelogs from AWS S3, you must also have the following permissions:

"s3:PutObject",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts"

6. (Optional) Specify custom values for Liquibase parameters for Amazon DynamoDB Secure. This is only necessary if you do not want to use the default Liquibase values. You can set these in your command line (CLI), in your liquibase.properties file, or as environment variables. There are two groups of parameters:

  • Those that specify the initial billing modes and read/write capacity for Liquibase tracking tables: DATABASECHANGELOG and DATABASECHANGELOGLOCK.

  • Those that specify the number of polling attempts, time between attempts, total timeouts, and timeout behavior for the DynamoDB waiter to use when running create, update, and delete operations through Liquibase.

3

Establish a connection

1. Ensure your Amazon DynamoDB database is configured. For more information, see Amazon: Setting Up DynamoDB.

2. Specify the database URL in the liquibase.properties file (defaults file), along with other properties you want to set a default value for. Liquibase does not parse the URL. You can either specify the full database connection string or specify the URL using your database's standard connection format:

  • Cloud: url: https://dynamodb.<region>.amazonaws.com

  • Local: url: dynamodb://localhost:8000

Note: For a list of AWS regions and other parameters that you can use in your URL, see AWS service endpoints. For example, url: https://dynamodb.us-west-2.amazonaws.com.

4

Test your connection

1. Create a text file called changelog (.yaml, .json, or .xml) in your project directory and add a changeset.

loading

loading

loading

2. Navigate to your project folder in the CLI and run the Liquibasestatuscommand to see whether the connection is successful:

liquibase status --changelog-file=<changelog.xml>

Note:You can specify arguments in the CLI or keep them in the Liquibase properties file.

If your connection is successful, you'll see a message like this:

4 changesets have not been applied to <your_connection_url> Liquibase command 'status' was executed successfully.

3. Execute these changes to your database with theupdatecommand:

liquibase update --changelog-file=<changelog.xml>

If yourupdateis successful, Liquibase runs each changeset and displays a summary message ending with:

Liquibase: Update has been successful. Liquibase command 'update' was executed successfully.

4. From a database UI tool, ensure that your database contains theMusic3<format>object you added along with the DATABASECHANGELOG table and DATABASECHANGELOGLOCK table.

Now you're ready to start deploying database changes with Liquibase.

Supported features

To see a list of supported Liquibase features in Amazon DynamoDB, see the Liquibase Amazon DynamoDB Secure Extension Overview.

You can use most Liquibase commands in Amazon DynamoDB except database inspection commands and commands that generate SQL.

For examples of Change Types and parameters for Amazon DynamoDB, see the following pages:

Troubleshooting

As of the Liquibase DynamoDB extension version 1.1.0, if you use Maven, you cannot specify Liquibase Parameters for Amazon DynamoDB Secure directly in your pom.xml file. For example, the following syntax does not work in your POM:

<liquibase.dynamodb.waiter.create.maxAttempts>-1</liquibase.dynamodb.waiter.create.maxAttempts>

Instead, you must specify them in a liquibase.properties file that you reference in your POM. For example:

<plugin> <groupId>org.liquibase</groupId> <artifactId>liquibase-maven-plugin</artifactId> <configuration> <propertyFile>src/main/resources/liquibase/liquibase.properties</propertyFile> </configuration> <plugin>

Then, in your liquibase.properties file, you can specify the DynamoDB parameter(s). For example:

liquibase.dynamodb.waiter.create.maxAttempts: -1

PreviousWhat is the Liquibase Amazon DynamoDB Secure extension?NextDynamoDB transaction retry behavior