Security and privacy

DynamoOps is an Electron application with an embedded local backend. The interface talks to that backend over the loopback interface, and the backend talks to AWS with the official AWS SDK for JavaScript v3. There is no DynamoOps cloud at all: queries, results and edits travel directly between your machine and AWS, and the app never contacts any DynamoOps server. Because the code is public, you can verify this yourself on GitHub.

CopyYour machine                                   AWS
┌───────────────────────────────────┐
│  DynamoOps UI  ⇄  local backend   │ ⇄ HTTPS ⇄  DynamoDB · STS · SSO · CloudWatch
└───────────────────────────────────┘

• Long-term access keys are read by the AWS SDK from ~/.aws or environment variables. DynamoOps never asks for them, displays them or copies them.
• Assume Role and SSO role credentials live in the backend’s memory and are discarded on logout, switch or quit.
• SSO access tokens and the OIDC client registration are cached in the app support folder with file mode 0600 so you are not sent to the browser on every launch. Forget this SSO session deletes them.
• Saved profiles, recents and role history store identifiers only.

The embedded backend runs with your AWS credentials, so it is locked down to the app itself.

• It listens on 127.0.0.1 only, never on your network interfaces.
• It rejects requests whose Host or Origin is not the app, which protects against DNS rebinding and against websites open in your browser calling it.
• Data read from DynamoDB is treated as untrusted and escaped before it is rendered, and a strict Content Security Policy blocks inline scripts as a second layer.
• The Electron window runs sandboxed, without Node.js access, cannot navigate away from the app and only opens https: links in your default browser.

Non-sensitive preferences and history are kept in the app’s local storage on this machine:

• Saved profiles, recent connections, role history and the last SSO form values.
• Query history (last 50), item version snapshots (up to 20 per item), item templates.
• Theme, JSON format preference and the cost alert threshold.

Version snapshots and query history can contain item data and key values from your tables. If that is a concern on a shared machine, clear history from the app and delete the application support folder on uninstall. See where DynamoOps stores data.

Grant the principal DynamoOps uses only what you need. Browsing requires list and describe plus read operations; writes, streams and schema management each add specific actions.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "dynamodb:ListTables", "dynamodb:DescribeTable",
      "dynamodb:Scan", "dynamodb:Query", "dynamodb:GetItem",
      "dynamodb:PartiQLSelect"
    ],
    "Resource": "*"
  }]
}