DynamoDB Credentials

[markyarnold]

Hi,

This may be me, but where exactly am I supposed to put the AWS creds to enable account access to DDB? There appears to be nowhere to add the keys?

[debba]

Hi Mark, not you at all, the form is genuinely misleading right now. The DynamoDB plugin doesn't ship its own connection UI yet, so Tabularis falls back to the generic host/port/username/password form, and the plugin quietly maps those fields onto AWS ones. It's just not written down anywhere, which is on us.

For a real AWS account, fill it in like this:

Field	Value
Host	dynamodb.<region>.amazonaws.com (e.g. dynamodb.us-east-1.amazonaws.com)
Port	443
Username	your AWS Access Key ID
Password	your AWS Secret Access Key

The region is picked up from the hostname, and port 443 switches the endpoint to https. Then hit Test Connection.

A couple of notes:

• Don't leave Host empty. Right now the plugin needs an endpoint to work out the region, so with only the keys filled in you'll get a connection params required error. That's a bug on our side, I've listed it below.
• If you're using DynamoDB Local instead, it's just localhost / 8000 and any non-empty username/password.

We'll get a proper connection form (region picker, profile, session token) into the plugin so nobody has to guess this. Leaving the issue open to track that.

[debba]

@fuleinist a few follow-ups that came out of this one, roughly in order of effort:

1. Region fallback without an endpoint. In normalized_params the region default (extra["region"] → plugin default-region setting → us-east-1) only kicks in when endpoint is set (src/handlers/connection.rs, the inner.contains_key("endpoint") guard). With just username/password and an empty host, has_explicit_creds stays false and the connection is rejected. The fallback should also run when access key + secret are present, so "keys only + default region in settings" works. Should be a small change plus a test next to generic_gui_form_is_accepted.

2. Document the generic-form mapping in the README. The "Connection Configuration" section only lists the internal param names (access_key_id, secret_access_key, ...). It should say what to type into the actual Tabularis form: host = dynamodb.<region>.amazonaws.com, port 443, username = access key, password = secret. Probably worth a short line in the .tabularium description too.

3. Plugin-owned connection fields. The host side landed in feat(connections): opaque plugin-specific extra fields for ConnectionParams tabularis#596 (connection-modal.extra_fields slot, extra map on ConnectionParams) and is in 0.23.0. The plugin already reads extra["region"], but there's no ui/ bundle using the slot, so the region selector is still only the global plugin setting. A first cut would be a region select plus optional profile and session token fields, and relabelling username/password as Access Key ID / Secret Access Key.

Happy to pick up 1 and 2 if you'd rather focus on 3.

[markyarnold]

Thats great, thanks - works a treat.

[fuleinist]

Thanks @debba , All three suggestions are drafted per below. Will add you as reviewer as well 👍

#	Follow-up	Issue	PR
1	Region fallback without an endpoint	#71	#74
2	Document the generic-form mapping	#72	#75
3	Plugin-owned connection fields	#73	#76

1 — region fallback (#74). normalized_params now runs the fallback chain when the connection has something to sign with — an endpoint or a complete access-key/secret pair — instead of only when an endpoint is present. Blank endpoint/region/profile also count as "not supplied" so they can't shadow a fallback (the GUI sends empty strings rather than omitting fields). Same payload before/after: -32602 connection params required → reaches the service and fails on UnrecognizedClientException (fake key), which is the correct outcome. 10 new unit tests, plus the #29 validation guard is unchanged.

2 — docs (#75). "Connection Configuration" now leads with the mapping rather than the internal param names: HOST = dynamodb.<region>.amazonaws.com, PORT = 443, USERNAME = Access Key ID, PASSWORD = Secret Access Key. Added a region-resolution table (extra["region"] → endpoint hostname → plugin setting → us-east-1), a runnable DynamoDB Local snippet, and demoted the internal names to a "Raw JSON-RPC parameters" subsection. Short line added to the .tabularium description too.

3 — connection fields (#76). First cut of the ui/ bundle on connection-modal.extra_fields (0.23.0 / plugin-api 0.1.1): region select with the 34 regions plus a "Default (plugin setting)" option, optional profile and session token, driver-gated on dynamodb. Plugin side now promotes extra["profile"] and extra["session_token"] onto the SDK params — explicit top-level values win, blanks are ignored, and a chosen profile keeps the region fallbacks out of the way. 13 Rust tests + 22 UI tests, the latter including a bundle-contract test that evaluates dist/index.js through the host's exact new Function(React, ReactJSXRuntime, __TABULARIS_API__, … __tabularis_plugin__ …) loading path and renders it, so a wrong IIFE name or a bundled copy of React fails in CI instead of silently in the modal. There's a new ui CI job (green) and a just test-ui recipe for local runs.

One thing I couldn't do from the plugin side: relabel USERNAME/PASSWORD as Access Key ID / Secret Access Key. There's no per-field label override in the manifest and the plugin guide forbids DOM manipulation outside the component's subtree, so #76 carries a hint line under the fields instead. If you want the real labels, that wants a relabel capability on the connection-modal slot in core.

Worth knowing for merge order: the per-connection region from #76 is only half the story until #74 lands — on main the fallback still requires an endpoint, so "region selected + keys, no host" only connects once both are in. They're based on main independently, so either order works.

I haven't had the app open against the branch, so #76's fields are verified through the host-contract test and the slot shape in PluginSlotProvider.tsx/slots.ts rather than by eye in the modal — happy to do a GUI pass before it goes in if you want one.