AWS DynamoDB 跨账号与跨 Region 复制

same account + cross Region:
    use DynamoDB Global Tables

cross account + shared access only:
    use DynamoDB resource-based policy
    no independent copy is created

cross account + independent table copy:
    historical data = PITR Export to S3 + Import from S3
    ongoing changes = DynamoDB Streams or Kinesis Data Streams CDC + consumer

cross account backup / restore:
    use AWS Backup cross-account copy
    not continuous replication

MREC - Multi-Region Eventual Consistency:
    multi-active
    cross-Region replication is asynchronous
    concurrent conflicts use last-writer-wins reconciliation
    lower write latency than synchronous cross-Region confirmation

MRSC - Multi-Region Strong Consistency:
    strongly consistent multi-Region reads and writes
    designed for zero RPO
    Region combinations, replica/witness topology, latency, quotas,
    unsupported features, and migration constraints must be checked first

Account A / ap-east-1 table
    -> can add replica in Account A / ap-southeast-1
    -> cannot add replica in Account B / ap-southeast-1

Account B application role
    -> cross-account DynamoDB API request
    -> Account A table

result:
    one physical table
    no data copy
    no independent retention or failure isolation
    request latency depends on table Region

central platform table shared by several accounts
temporary migration access
organization wants one source of truth
Account B does not require an independent recovery copy

Account A outage or policy error must not affect Account B
Account B needs its own table lifecycle and encryption ownership
data residency requires another Region copy
Account B must continue after Account A is decommissioned

Account A / Region A

DynamoDB A1
    |
    | point-in-time snapshot at T0
    +----------------> Export to S3 ----------------+
    |                                                |
    | CDC after T0                                   v
    +----------------> Kinesis Data Streams      Import from S3
                             |                       |
                             v                       v
                       Lambda / consumer       DynamoDB B2
                             |                       ^
                             | AssumeRole           |
                             +-----------------------+

                                      Account B / Region B

snapshot only:
    exports historical state at T0
    misses writes after T0

CDC only:
    captures changes after it was enabled
    does not reconstruct all older unchanged items

snapshot + CDC:
    snapshot establishes baseline
    CDC catches changes after snapshot time

stop all writers to A1
    -> wait until snapshot time T0 is restorable（停机后，等待Point-in-time recovery (PITR)自动做一次时间是在你停机之后的最新备份 ）
    -> PITR Export A1 at T0 to S3
    -> Import from S3 creates B2
    -> configure and validate B2
    -> switch application to Account B
    -> resume writes on B2

source table:
    table ARN and Region
    partition key / sort key name and type
    item count and table size
    GSI and LSI definitions
    billing mode, capacity, maximum throughput, table class
    PITR, deletion protection, TTL attribute
    stream / Kinesis destination
    encryption key, tags, resource policy

destination:
    Account B Region and target table name
    S3 bucket owner, prefix, bucket policy, encryption key
    destination DynamoDB KMS key
    import quota and expected write/read capacity after cutover

aws dynamodb describe-table --profile account-a --region ap-east-1 --table-name A1 --query 'Table.LocalSecondaryIndexes'

null or []:
    A1 没有 LSI
    可以继续使用原生 Export to S3 + ImportTable

returns index definitions:
    A1 使用 LSI
    必须确认 B2 是否仍需要这些 LSI access patterns

GSI:
    ImportTable supports GlobalSecondaryIndexes in TableCreationParameters
    DynamoDB creates the GSI while creating B2

LSI:
    ImportTable does not support LocalSecondaryIndexes
    LSI cannot be added after table creation

aws dynamodb describe-table --profile account-a --region ap-east-1 --table-name A1 --query 'Table.{LSI:LocalSecondaryIndexes,GSI:GlobalSecondaryIndexes}'

Account A:
    stop A1 writes
    -> PITR Export at T0
    -> S3 AWSDynamoDB/<export-id>/data/

Account B preparation:
    do NOT create B2 beforehand
    prepare import IAM permissions
    prepare S3 bucket policy and KMS key policy
    prepare TableCreationParameters:
        TableName = B2
        AttributeDefinitions
        KeySchema
        GlobalSecondaryIndexes, if required
        BillingMode / ProvisionedThroughput
        SSESpecification

Account B execution:
    call ImportTable with S3 data prefix + TableCreationParameters
    -> DynamoDB creates B2
    -> DynamoDB loads S3 data into B2
    -> wait until ImportStatus = COMPLETED
    -> configure PITR / TTL / deletion protection / alarms / IAM
    -> validate and cut over application

B2 does not already exist:
    ImportTable always creates a new table
    it cannot merge into or overwrite an existing B2

schema is explicit:
    partition key and sort key name/type are correct
    required GSI definitions are included in TableCreationParameters

input is correct:
    S3KeyPrefix points to the export data/ directory, not manifest files
    InputFormat and InputCompressionType match the exported files

permissions are complete:
    Account B import caller can read the S3 prefix
    cross-account bucket policy allows access
    source/destination KMS key policies allow required decrypt/encrypt operations

post-import settings are rebuilt:
    PITR, TTL, deletion protection, auto scaling, alarms, tags,
    resource policy and application IAM are configured separately

application services and background workers
Lambda / Step Functions / scheduled jobs
ETL, admin scripts, repair jobs, console writes
stream consumers that write back to A1
TTL background deletion, if exact item set must remain unchanged

aws dynamodb describe-continuous-backups --profile account-a --region ap-east-1 --table-name A1

PointInTimeRecoveryStatus = ENABLED
EarliestRestorableDateTime
LatestRestorableDateTime

aws dynamodb export-table-to-point-in-time --profile account-a --region ap-east-1 --table-arn arn:aws:dynamodb:ap-east-1:111111111111:table/A1 --export-time 2026-08-22T10:00:00Z --s3-bucket account-b-dynamodb-migration --s3-bucket-owner 222222222222 --s3-prefix A1/T0 --s3-sse-algorithm AES256 --export-format DYNAMODB_JSON

Account A export requester role identity policy:
    allows the role to call DynamoDB export
    allows the role to write the Account B S3 prefix

Account B destination bucket policy:
    trusts the exact Account A export requester role
    allows that role to write the migration prefix

principal:
    use the Account A IAM role that calls export-table-to-point-in-time
    do not set Principal to dynamodb.amazonaws.com

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ExportA1",
      "Effect": "Allow",
      "Action": [
        "dynamodb:ExportTableToPointInTime",
        "dynamodb:DescribeTable",
        "dynamodb:DescribeContinuousBackups"
      ],
      "Resource": "arn:aws:dynamodb:ap-east-1:111111111111:table/A1"
    },
    {
      "Sid": "ReadExportStatus",
      "Effect": "Allow",
      "Action": [
        "dynamodb:DescribeExport",
        "dynamodb:ListExports"
      ],
      "Resource": "*"
    },
    {
      "Sid": "WriteAccountBMigrationPrefix",
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Resource": "arn:aws:s3:::account-b-dynamodb-migration/A1/T0/*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAccountAExportRoleWriteA1Prefix",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:role/dynamodb-a1-export-role"
      },
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Resource": "arn:aws:s3:::account-b-dynamodb-migration/A1/T0/*"
    }
  ]
}

aws s3api put-bucket-ownership-controls --profile account-b --region ap-southeast-1 --bucket account-b-dynamodb-migration --ownership-controls 'Rules=[{ObjectOwnership=BucketOwnerEnforced}]'

aws dynamodb export-table-to-point-in-time --profile account-a --region ap-east-1 --table-arn arn:aws:dynamodb:ap-east-1:111111111111:table/A1 --export-time 2026-08-22T10:00:00Z --s3-bucket account-b-dynamodb-migration --s3-bucket-owner 222222222222 --s3-prefix A1/T0 --s3-sse-algorithm KMS --s3-sse-kms-key-id arn:aws:kms:ap-southeast-1:222222222222:key/MIGRATION-KEY-ID --export-format DYNAMODB_JSON

{
  "Sid": "AllowAccountAExportRoleEncryptMigrationObjects",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::111111111111:role/dynamodb-a1-export-role"
  },
  "Action": [
    "kms:Encrypt",
    "kms:GenerateDataKey",
    "kms:DescribeKey"
  ],
  "Resource": "*"
}

bucket policy Principal 写成 dynamodb.amazonaws.com，而不是 Account A requester role
Account A role 有 S3 identity permission，但 Account B bucket policy 没有 cross-account allow
bucket policy 的 prefix 与 --s3-prefix 不一致
bucket policy/SCP/VPC endpoint policy 中存在 explicit deny
bucket 强制 KMS，但 export command 没有指定允许跨账号使用的 customer managed key
KMS identity policy 已允许，但 Account B key policy 没有信任 Account A role

{
  "TableName": "B2",
  "AttributeDefinitions": [
    {
      "AttributeName": "pk",
      "AttributeType": "S"
    },
    {
      "AttributeName": "sk",
      "AttributeType": "S"
    }
  ],
  "KeySchema": [
    {
      "AttributeName": "pk",
      "KeyType": "HASH"
    },
    {
      "AttributeName": "sk",
      "KeyType": "RANGE"
    }
  ],
  "BillingMode": "PAY_PER_REQUEST",
  "SSESpecification": {
    "Enabled": true,
    "SSEType": "KMS",
    "KMSMasterKeyId": "arn:aws:kms:ap-southeast-1:222222222222:key/DESTINATION-KEY-ID"
  }
}

AttributeDefinitions:
    include every table primary key and GSI key attribute
    do not list ordinary non-key attributes

GlobalSecondaryIndexes:
    define IndexName
    define GSI KeySchema
    define Projection
    define GSI ProvisionedThroughput only when BillingMode=PROVISIONED

table primary key:
    pk  HASH String
    sk  RANGE String

GSI status-created-at-index:
    gsi_status  HASH String
    created_at  RANGE String
    projection includes total_amount and currency

{
  "TableName": "B2",
  "AttributeDefinitions": [
    {
      "AttributeName": "pk",
      "AttributeType": "S"
    },
    {
      "AttributeName": "sk",
      "AttributeType": "S"
    },
    {
      "AttributeName": "gsi_status",
      "AttributeType": "S"
    },
    {
      "AttributeName": "created_at",
      "AttributeType": "S"
    }
  ],
  "KeySchema": [
    {
      "AttributeName": "pk",
      "KeyType": "HASH"
    },
    {
      "AttributeName": "sk",
      "KeyType": "RANGE"
    }
  ],
  "GlobalSecondaryIndexes": [
    {
      "IndexName": "status-created-at-index",
      "KeySchema": [
        {
          "AttributeName": "gsi_status",
          "KeyType": "HASH"
        },
        {
          "AttributeName": "created_at",
          "KeyType": "RANGE"
        }
      ],
      "Projection": {
        "ProjectionType": "INCLUDE",
        "NonKeyAttributes": [
          "total_amount",
          "currency"
        ]
      }
    }
  ],
  "BillingMode": "PAY_PER_REQUEST",
  "SSESpecification": {
    "Enabled": true,
    "SSEType": "KMS",
    "KMSMasterKeyId": "arn:aws:kms:ap-southeast-1:222222222222:key/DESTINATION-KEY-ID"
  }
}

{
  "BillingMode": "PROVISIONED",
  "ProvisionedThroughput": {
    "ReadCapacityUnits": 100,
    "WriteCapacityUnits": 100
  },
  "GlobalSecondaryIndexes": [
    {
      "IndexName": "status-created-at-index",
      "KeySchema": [
        {
          "AttributeName": "gsi_status",
          "KeyType": "HASH"
        },
        {
          "AttributeName": "created_at",
          "KeyType": "RANGE"
        }
      ],
      "Projection": {
        "ProjectionType": "INCLUDE",
        "NonKeyAttributes": [
          "total_amount",
          "currency"
        ]
      },
      "ProvisionedThroughput": {
        "ReadCapacityUnits": 100,
        "WriteCapacityUnits": 100
      }
    }
  ]
}

aws dynamodb describe-table --profile account-a --region ap-east-1 --table-name A1 --query 'Table.{AttributeDefinitions:AttributeDefinitions,KeySchema:KeySchema,GlobalSecondaryIndexes:GlobalSecondaryIndexes[].{IndexName:IndexName,KeySchema:KeySchema,Projection:Projection}}'

TARGET_TABLE=B2
TARGET_KMS_KEY_ARN=arn:aws:kms:ap-southeast-1:222222222222:key/DESTINATION-KEY-ID

aws dynamodb describe-table --profile account-a --region ap-east-1 --table-name A1 --output json | jq --arg target_table "${TARGET_TABLE}" --arg target_kms_key_arn "${TARGET_KMS_KEY_ARN}" '
      .Table as $source
      | if (($source.LocalSecondaryIndexes // []) | length) > 0 then
          error("A1 has LSI; native ImportTable cannot preserve it")
        else
          ($source.BillingModeSummary.BillingMode // "PROVISIONED") as $billing_mode
          | (
              {
                TableName: $target_table,
                AttributeDefinitions: $source.AttributeDefinitions,
                KeySchema: $source.KeySchema,
                BillingMode: $billing_mode,
                SSESpecification: {
                  Enabled: true,
                  SSEType: "KMS",
                  KMSMasterKeyId: $target_kms_key_arn
                }
              }
              + (
                  if $billing_mode == "PROVISIONED" then
                    {
                      ProvisionedThroughput: {
                        ReadCapacityUnits: $source.ProvisionedThroughput.ReadCapacityUnits,
                        WriteCapacityUnits: $source.ProvisionedThroughput.WriteCapacityUnits
                      }
                    }
                  else
                    {}
                  end
                )
              + (
                  if (($source.GlobalSecondaryIndexes // []) | length) > 0 then
                    {
                      GlobalSecondaryIndexes: [
                        $source.GlobalSecondaryIndexes[]
                        | (
                            {
                              IndexName: .IndexName,
                              KeySchema: .KeySchema,
                              Projection: .Projection
                            }
                            + (
                                if $billing_mode == "PROVISIONED" then
                                  {
                                    ProvisionedThroughput: {
                                      ReadCapacityUnits: .ProvisionedThroughput.ReadCapacityUnits,
                                      WriteCapacityUnits: .ProvisionedThroughput.WriteCapacityUnits
                                    }
                                  }
                                else
                                  {}
                                end
                              )
                          )
                      ]
                    }
                  else
                    {}
                  end
                )
            )
        end
    ' > import-table-parameters.json

jq . import-table-parameters.json

must verify:
    TableName is the new Account B table name
    AttributeDefinitions contains only table/GSI key attributes
    KeySchema matches A1
    every required GSI has correct key schema and projection
    BillingMode and capacity are appropriate for cutover traffic
    KMSMasterKeyId belongs to Account B and the destination Region

not automatically carried by this generator:
    on-demand maximum throughput and warm throughput
    table class
    TTL, PITR, deletion protection
    auto scaling, alarms, tags
    resource policy and application IAM

aws dynamodb import-table --profile account-b --region ap-southeast-1 --s3-bucket-source S3BucketOwner=222222222222,S3Bucket=account-b-dynamodb-migration,S3KeyPrefix=A1/T0/AWSDynamoDB/EXPORT-ID/data/ --input-format DYNAMODB_JSON --input-compression-type GZIP --table-creation-parameters file://import-table-parameters.json

aws dynamodb describe-import --profile account-b --region ap-southeast-1 --import-arn arn:aws:dynamodb:ap-southeast-1:222222222222:table/B2/import/IMPORT-ID --query 'ImportTableDescription.{Status:ImportStatus,Processed:ProcessedItemCount,Imported:ImportedItemCount,Errors:ErrorCount,FailureCode:FailureCode,FailureMessage:FailureMessage}'

IN_PROGRESS:
    B2 is being created and data is being loaded
    application must not cut over yet

COMPLETED:
    import service finished
    continue schema/configuration/data validation before cutover

FAILED or ErrorCount > 0:
    inspect FailureCode / FailureMessage and import error logs
    do not use B2 as a completed migration

data:
    export ItemCount vs import ImportedItemCount
    import ErrorCount = 0
    sample GetItem for known keys
    critical migration uses partitioned Scan + deterministic item hash

schema and query:
    partition/sort key types match
    every required GSI is ACTIVE
    representative Query and GSI Query return expected results

table configuration:
    TTL decision applied
    PITR and deletion protection enabled
    billing/capacity/auto scaling configured
    KMS, tags, resource policy, application IAM, alarms configured

application:
    credentials and table Region/name changed
    read/write/delete smoke test passes on B2
    no application component still writes A1

[ ] 停机时长已按生产规模演练
[ ] 所有 A1 writers 和 TTL 行为已盘点
[ ] PITR 已启用且 LatestRestorableDateTime 覆盖 T0
[ ] export status = COMPLETED
[ ] import source prefix 只包含 export data files
[ ] A1 没有无法由 Import from S3 重建的 LSI 要求
[ ] B2 key schema、GSI、KMS 和 billing mode 正确
[ ] import status = COMPLETED and ErrorCount = 0
[ ] item count、抽样 item、hash 和 query 已对账
[ ] B2 PITR、TTL、deletion protection、IAM 和 alarms 已配置
[ ] 应用 smoke test 通过，且 A1 保持无写入
[ ] 已明确 B2 接受新写入后的回滚办法

A1 Streams NEW_AND_OLD_IMAGES
    -> Lambda in Account A
    -> AssumeRole into Account B
    -> PutItem / DeleteItem on B2

A1 PITR at T0
    -> ExportTableToPointInTime
    -> S3 DynamoDB JSON or Ion files
    -> ImportTable
    -> new B2 table

Import creates a new table:
    target table name and settings are chosen during import
    cannot merge into or overwrite an existing B2 table

table configuration:
    verify partition key and sort key types
    recreate GSI definitions intentionally
    review billing mode, capacity, table class, deletion protection, PITR, TTL, tags
    verify customer managed KMS key in Account B

data validation:
    compare export item count with imported item count
    sample keys from different partitions
    validate number, binary, list, map, empty value, and large item handling

def apply_record(record, destination_client, table_name):
    event_name = record["eventName"]
    keys = record["dynamodb"]["Keys"]

    if event_name in ("INSERT", "MODIFY"):
        destination_client.put_item(
            TableName=table_name,
            Item=record["dynamodb"]["NewImage"],
        )
    elif event_name == "REMOVE":
        destination_client.delete_item(
            TableName=table_name,
            Key=keys,
        )

sync REMOVE:
    B2 current state follows A1
    recommended for migration / read replica

ignore TTL REMOVE:
    B2 keeps historical items
    only appropriate for archive use cases
    B2 needs independent retention and access controls

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:role/dynamodb-a1-cdc-consumer"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "WriteReplicatedItems",
      "Effect": "Allow",
      "Action": [
        "dynamodb:DescribeTable",
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:BatchWriteItem"
      ],
      "Resource": [
        "arn:aws:dynamodb:ap-southeast-1:222222222222:table/B2",
        "arn:aws:dynamodb:ap-southeast-1:222222222222:table/B2/index/*"
      ]
    }
  ]
}

recommended migration mode:
    A1 is the only writer before cutover
    B2 is replication-writer-only
    after CDC catches up, stop A1 writes and cut over once

avoid:
    applications write A1 and B2 concurrently
    B2 application writes race with CDC PutItem
    two-way CDC without loop prevention and conflict ownership

idempotency:
    repeated INSERT/MODIFY/REMOVE produces the same target state

ordering:
    preserve order for changes to the same item key
    do not assume global order across partition keys

stale event protection:
    include application version or updated_at when old events might arrive late
    use conditional writes when target can receive another writer

delete protection:
    an old MODIFY must not resurrect an item after a newer REMOVE

loop prevention:
    never send B2 changes back to A1 unless events carry origin and version controls

source:
    DynamoDB write throttles
    Kinesis streaming destination status

stream:
    IncomingRecords / IncomingBytes
    GetRecords.IteratorAgeMilliseconds
    read/write throttles

consumer:
    Lambda Errors / Throttles / Duration
    IteratorAge
    partial batch failures
    DLQ or failure destination depth

destination:
    UserErrors / SystemErrors
    write throttle events
    consumed write capacity

export/import item count reconciliation
sample GetItem by known keys
partitioned Scan with deterministic item hash for critical migrations
INSERT / MODIFY / REMOVE / TTL canary tests
GSI query result validation
consumer lag reaches zero before cutover
CloudTrail confirms only approved replication principal writes B2

same account, multi-Region active-active:
    Global Tables

cross account, no independent copy required:
    resource-based policy

cross account, one-time migration:
    PITR Export to S3 + Import from S3

cross account, historical + ongoing replication:
    PITR Export/Import + Kinesis CDC consumer

cross account, small table and migration completes within 24h:
    Export/Import or controlled backfill + DynamoDB Streams

cross account backup for restore only:
    AWS Backup cross-account copy

[ ] 已确认是共享访问、一次迁移、持续单向复制还是多活
[ ] 已确认 Global Tables 不能跨 account 创建 replica
[ ] A1 PITR 已启用，snapshot time T0 已记录
[ ] Kinesis retention 覆盖 export/import/验证/重试时间
[ ] B2 key schema、GSI、billing、capacity、TTL、PITR、KMS 已确认
[ ] Account B writer role 只授权 B2 所需 actions
[ ] CDC consumer 处理 INSERT/MODIFY/REMOVE 和 TTL
[ ] consumer 支持幂等、partial failure、DLQ 和 checkpoint
[ ] B2 在 cutover 前没有未受控业务写入
[ ] item count、抽样 hash、GSI query 和 delete behavior 已对账
[ ] consumer lag 归零后才执行 cutover
[ ] rollback window 和旧表下线策略已确认