DynamoDB export to Amazon S3 creates an asynchronous copy of table data at a point in time. Use it to analyze data outside DynamoDB, keep an export in another account or Region, or prepare data for a migration. Exports read from point-in-time recovery (PITR) backups, do not consume table read capacity, and require PITR to be enabled first. See AWS's export overview.

This guide walks through a full export from the console or AWS CLI. DynamoDB also supports incremental exports for changes within a time window and filtered exports for selected items or attributes. An S3 export is a file set for offline use; it does not continuously replicate a table or restore a table by itself.

Required setup

Before starting, identify the source table, destination bucket and prefix, the point in time to export, and the principal that will request the job.

Enable point-in-time recovery (PITR)

PITR is required for every DynamoDB export. It retains a rolling recovery window that can be configured from 1 to 35 days; choose an export time within the table's configured window. The default window is 35 days. Enable it from the table's point-in-time recovery settings in the DynamoDB console, or use the PITR documentation for current console and API instructions.

Grant export permissions

The IAM user or role making the request needs permission to export the source table and write the export objects to S3. The example below limits access to one table and one object prefix. Replace the Region, account ID, table, and bucket with your values, then attach the policy to the principal that starts the export.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ExportOneTable",
      "Effect": "Allow",
      "Action": "dynamodb:ExportTableToPointInTime",
      "Resource": "arn:aws:dynamodb:REGION:ACCOUNT_ID:table/TABLE_NAME"
    },
    {
      "Sid": "DescribeExportsForStatusChecks",
      "Effect": "Allow",
      "Action": "dynamodb:DescribeExport",
      "Resource": "arn:aws:dynamodb:REGION:ACCOUNT_ID:table/TABLE_NAME/export/*"
    },
    {
      "Sid": "WriteExportObjects",
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Resource": "arn:aws:s3:::BUCKET_NAME/exports/TABLE_NAME/*"
    }
  ]
}

This identity policy can start an export, inspect its status, and write its files, but it omits console browsing permissions and customer-managed-key permissions. Console navigation may require separate read and list actions. The export ARN resource format for dynamodb:DescribeExport is in the DynamoDB Service Authorization Reference. For a bucket in another account, its owner must also allow the requesting principal to write to the destination prefix. For a broader explanation of S3 identity policies, bucket policies, and cross-account access, see AWS S3 Guide: Understanding Access Management. The export request must be made by a principal in the source table's account; if needed, assume a role in that account. For a cross-account destination bucket, also include its owner's account ID with --s3-bucket-owner.

Customer-managed keys need separate permissions for each purpose. For a source table encrypted with a customer-managed key, allow the caller and DynamoDB to use that specific table key, including kms:Decrypt, so DynamoDB can decrypt the table data. For an export bucket encrypted with SSE-KMS, grant the caller access to that specific key in IAM and the key policy; S3 multipart uploads require kms:GenerateDataKey and kms:Decrypt. The export key must be in the destination bucket's Region. Scope the caller's IAM permissions to the required key ARNs. In a KMS key policy, Resource "*" refers to the key the policy is attached to. See AWS's DynamoDB export encryption requirements, DynamoDB encryption guidance, and S3 SSE-KMS permissions for the exact key policies and permissions.

Prepare the S3 destination

Choose a bucket and an optional prefix such as exports/orders. The bucket can be in a different account or Region from the table; it does not need to be in the table's Region. Requester-pays buckets are not supported. Keep the bucket private and set retention or lifecycle rules according to how long the export must remain available. By default, DynamoDB uses SSE-S3 encryption; SSE-KMS is also available when its key permissions and Region are configured correctly. AWS documents the destination-bucket requirements in its export prerequisites.

Choose the export type

  • Full export: a snapshot at one point in the PITR window. Choose it for a periodic snapshot, analytics, or a migration baseline.
  • Incremental export: items changed during an interval of 15 minutes to 24 hours. The start is inclusive and the end is exclusive; choose new images only or both new and old images.
  • Filtered export: an optional item or attribute selection that can be combined with a full or incremental export. The CLI example below shows its expressions and limits.

Exports are not transactionally consistent across multiple items in one DynamoDB transaction. If a consumer needs a transaction-wide atomic view, account for this limitation; see AWS's export documentation.

Export a table from the console

  1. In the DynamoDB console, open Exports to S3 in the navigation pane and choose Export to S3.
  2. Select the source table and destination bucket. Enter a prefix if you want exports grouped under a path.
  3. Choose full or incremental export and its time or interval. Select DynamoDB JSON or Amazon Ion and the requested S3 encryption.
  4. Review the destination and start the export. The console shows the export job status.

For the current console flow and available settings, see AWS's console export instructions.

Start and inspect an export with the AWS CLI

With the AWS CLI configured for the source table's account, run the following command. Replace the uppercase placeholders. The command starts a full export at the latest restorable point in the PITR window and prints its export ARN. Omitting --export-time uses that latest restorable point; it does not mean the current wall-clock instant. Supply --export-time when you need a particular time within the recovery window.

aws dynamodb export-table-to-point-in-time \
  --table-arn arn:aws:dynamodb:REGION:ACCOUNT_ID:table/TABLE_NAME \
  --s3-bucket BUCKET_NAME \
  --s3-prefix exports/TABLE_NAME \
  --export-format DYNAMODB_JSON \
  --region REGION \
  --query 'ExportDescription.ExportArn' \
  --output text

For a cross-account destination, add --s3-bucket-owner BUCKET_OWNER_ACCOUNT_ID after granting the principal access in the bucket policy. The CLI's --region is the source table's Region, even when the destination bucket is elsewhere.

Save the ARN returned by the first command and use it to check the job. Replace EXPORT_ARN and REGION with the returned ARN and source Region:

aws dynamodb describe-export \
  --export-arn EXPORT_ARN \
  --region REGION \
  --query 'ExportDescription.{Status:ExportStatus,Failure:FailureMessage,Items:ItemCount}'

The job is asynchronous. Check again until ExportStatus is COMPLETED or FAILED; if it fails, inspect FailureCode and FailureMessage. Do not assume a fixed completion time: duration depends on the export and AWS does not guarantee a completion window. See the export behavior documentation and the AWS CLI command reference.

Export selected items and attributes

Filtered export can narrow a full or incremental export to matching items and selected attributes. Use a current AWS CLI v2 that supports --filter-specification. The following optional specification selects one tenant partition, keeps active items, and returns three attributes. Save it as filter-specification.json, replacing the key and attribute names and values to match your table's schema.

{
  "KeyConditionExpression": "#tenant = :tenantId",
  "FilterExpression": "#state = :state",
  "ProjectionExpression": "#tenant, #state, #updated",
  "ExpressionAttributeNames": {
    "#tenant": "tenantId",
    "#state": "status",
    "#updated": "updatedAt"
  },
  "ExpressionAttributeValues": {
    ":tenantId": {"S": "tenant-123"},
    ":state": {"S": "active"}
  }
}

The next command uses that specification. Replace the uppercase placeholders as in the full-export command above:

aws dynamodb export-table-to-point-in-time \
  --table-arn arn:aws:dynamodb:REGION:ACCOUNT_ID:table/TABLE_NAME \
  --s3-bucket BUCKET_NAME \
  --s3-prefix exports/TABLE_NAME \
  --export-format DYNAMODB_JSON \
  --filter-specification file://filter-specification.json \
  --region REGION

A key condition selects one partition-key value and can optionally constrain the sort key. A filter expression screens items after DynamoDB reads them, so it does not reduce the data processed; use a key condition when the table's key design lets you narrow the export. A projection expression controls which attributes appear in the output. Filtered export launched on October 1, 2026 and is available in AWS Regions except the AWS GovCloud (US) Regions; check the filtering guide and availability announcement for current support.

Verify the exported files

Every export receives a service-generated ID beneath the prefix you supplied. A full DynamoDB JSON export typically has this structure:

Understand the export layout

s3://BUCKET_NAME/exports/TABLE_NAME/AWSDynamoDB/EXPORT_ID/
  manifest-summary.json
  manifest-summary.checksum
  manifest-files.json
  manifest-files.checksum
  data/
    *.json.gz

The summary manifest records details such as the table, export time, output format, item count, and export ARN. The files manifest lists the data object keys, item counts, and checksums. DynamoDB exports compressed DynamoDB JSON or Amazon Ion files; it does not export Parquet. Use the manifest rather than assuming a particular data filename. See the output format reference for the full layout and format details.

Check the export output

Confirm that the job completed, the expected prefix contains the manifests and data files, and the manifest's export time and item count match the request. For downstream analysis, Athena and AWS Glue can work with DynamoDB export data; the files use DynamoDB's typed attribute representation, so they are not ordinary application JSON. See AWS's export format notes before choosing a parser.

Schedule recurring exports

For a recurring workflow, schedule a Lambda function with EventBridge Scheduler to call the export API. Treat each invocation as job submission, not confirmation that files are ready; check the returned export ARN until its status is COMPLETED or FAILED before downstream consumers read the S3 prefix.

Costs and access

Security and access control

Keep the destination bucket private, grant write access only to the export principal and prefix, and check bucket and KMS key policies if writes fail. Do not grant broad bucket or KMS access just to make an export succeed. Revoke or change permissions only after an active export has finished; AWS warns that removing them during a job can leave partial files.

Managing costs

Plan for separate charges for PITR, the export, S3 requests, and S3 storage. DynamoDB export pricing depends on the data processed, and S3 charges depend on the destination's requests and retained objects. Check current regional rates on the DynamoDB pricing page and S3 pricing page; avoid using a fixed per-GB estimate without checking the Region and export type.