Connections

Assume Role (STS)

Connect with temporary credentials for an IAM role in any account. DynamoOps calls sts:AssumeRole for you, shows a live session countdown and offers one-click renewal.

When to use it

Use Assume Role when your local credentials belong to one account (or user) and the tables live behind an IAM role, typically in another account. DynamoOps performs the same STS call you would make with aws sts assume-role, then connects DynamoDB with the returned temporary credentials. Your long-term keys are only used to call STS.

What DynamoOps runs for you

aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/DevelopersRole \
  --role-session-name dev-session \
  --duration-seconds 3600 \
  --profile default

Fields

Account ID12 digitsrequired: The target AWS account. Dashes are stripped automatically.
Role Nametextrequired: The role to assume, for example DevelopersRole. DynamoOps builds the ARN arn:aws:iam::<account>:role/<name>.
AWS Profiletext: The local profile whose credentials call STS. default or empty uses the SDK default chain.
Regionselectrequired: Used both as the STS region and as the DynamoDB region to connect to.
Environmenttoggle: None, Dev, Staging or Prod. Shown as a header badge after connecting.
Session Nametext: Optional. Appears in CloudTrail as the role session name. Defaults to dev-session.
Save profilecheckbox: Store this configuration under a name in Saved Profiles.

Connecting

The Assume Role tab. Role history appears below the form once you have assumed roles.

Fill in the account and role
Type the 12-digit Account ID and the Role Name, then pick the region and the local profile.
Click Assume Role & Connect
DynamoOps requests credentials valid for one hour, validates them with a ListTables call and switches the whole app to the assumed role.
Confirm the badge
The header shows 🛡️ <RoleName> (mm:ss) with a live countdown, the provider badge ☁ AWS <region> and your environment tag.

If both the account and role are missing, DynamoOps asks you to fill them in before calling AWS. Any STS error is shown inline, for example “Assume Role failed: User … is not authorized to perform: sts:AssumeRole on resource …”.

What is not supported

External ID, MFA tokens, custom session durations, role chaining and custom endpoints are not available in this flow. If your role requires MFA, assume it with the AWS CLI into a named profile and use Quick Connect with that profile instead.

Session expiry and renewal

STS credentials expire after one hour. DynamoOps keeps you informed and lets you renew without leaving the workspace.

When	What happens
Whole session	The role badge counts down to expiry, updating every second.
5 minutes before expiry	A dialog warns that the session is about to expire and offers to renew now or ignore.
Renew	DynamoOps re-runs AssumeRole with the same parameters. Like any new connection, this closes open tabs and reloads the table list.
About 10 seconds after expiry	If you ignored the warning and the dialog is still open, it becomes a blocking prompt with a single renew action. If renewal fails, you are returned to the login screen.
Ignored entirely	No further prompts. API calls start failing once AWS rejects the expired credentials; reconnect from the login screen.

Role history

Below the form, DynamoOps keeps the last ten distinct role and profile combinations you have assumed, newest first. Each entry shows the role name, account id, the local profile (when it is not default) and the environment tag, colour-coded by environment. Clicking an entry pre-fills the form so you only have to press Assume Role & Connect.

Access denied shortcut

If you connect with credentials that lack dynamodb:ListTables, the sidebar replaces the table list with an access-denied banner naming the IAM principal and a button that jumps straight to the Assume Role tab. This is the quickest way to recover when a base profile can only assume roles and has no DynamoDB permissions of its own.

Minimum permission on the base principal: sts:AssumeRole on the target role.
Minimum permission on the target role: dynamodb:ListTables plus whatever the tables you open require.
Full details on where credentials are kept are in Security and privacy.

Connecting to DynamoDB

The login screen, the four connection methods, Quick Connect with AWS CLI profiles, environment tags, testing a connection and switching or logging out.

Saved profiles and recent connections

Reconnect in one click. Save Quick Connect, Assume Role and SSO configurations under a name, and pick up where you left off from the automatic recent list.

AWS SSO (IAM Identity Center)

Sign in through your organization’s AWS access portal in the browser, pick an account and permission set, and let DynamoOps renew role credentials silently while your session lasts.