DynamoDB Key Design
Scope. Aurora Postgres is the system of record; DynamoDB is used only for hot-path, transient, and append-only data. See ADR 0006 for the full Postgres/DynamoDB split. This page documents the key patterns for the entities that remain in DynamoDB.
Remaining DynamoDB Entities
| Entity | PK | SK |
|---|---|---|
| Audit Event | EVENT#scopeId#id | TIMESTAMP#epoch |
| Rate Limit | RATE#keyId | WINDOW#minute |
| Usage Counter | USAGE#orgId | MONTH#month |
| Telemetry Counter | TELEMETRY#scopeId | DAY#day#SOURCE#source#DIM#dim#EFFECT#effect |
| Webhook Delivery | SCOPE#scopeId | WEBHOOK_DELIVERY#endpointId#reversedTs#id |
| Anomaly Record | ORG#orgId | ANOMALY#dateHourMetric |
Why these stay in Dynamo
- Append-only / audit (Audit Event, Anomaly) with TTL auto-expiry to S3 cold storage — Postgres has no TTL.
- Transient counters (Rate Limit, Usage, Telemetry) — high-write
INCRworkloads with TTL. - Append-only retry queue (Webhook Delivery) with TTL.
Note
Historically most relational entities (scope, permission, role, access policy, API key, user identity,
tuples, …) lived in this single DynamoDB table. They have since moved to Postgres; their old key
patterns are no longer in use. Key builders live in apps/backend/src/domain/shared/dynamo-keys.ts.